diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 45971fa80f..685169ca43 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -13,7 +13,7 @@ azure-mgmt-core==1.2.1 azure-mgmt-network==19.0.0 azure-mgmt-resource==17.0.0 bcrypt==3.2.0 -boto3==1.17.74 +boto3==1.17.104 botocore==1.20.74 certifi==2020.12.5 cffi==1.14.5 diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 5e658d3da2..262fe73f3d 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -31,16 +31,28 @@ tags: automated_detection_testing: passed cis20: - CIS 16 + confidence: 50 + context: + - Source:Cloud Data + - Stage:Recon dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json + impact: 30 kill_chain_phases: - Actions on Objectives + message: user $user$ has made $api_calls$ api calls, violating the dynamic threshold + of $expected_upper_threshold$ with the following command $command$. mitre_attack_id: - T1078.004 nist: - DE.DP - DE.CM - PR.AC + observable: + - name: user + type: User + role: + - Attacker product: - Splunk Security Analytics for AWS - Splunk Enterprise @@ -51,17 +63,5 @@ tags: - All_Changes.command - All_Changes.user - All_Changes.status - security_domain: network - impact: 30 - confidence: 50 - # (impact * confidence)/100 risk_score: 15 - context: - - Source:Cloud Data - - Stage:Recon - message: user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. - observable: - - name: user - type: User - role: - - Attacker + security_domain: network diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index 2c9660e2b3..5da226a8fe 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -5,9 +5,9 @@ date: '2021-03-02' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for AWS CloudTrail events where a user A(victim A) creates - a login profile for user B, followed by a AWS Console login event from user B from - the same src_ip as user B. This correlated event can be indicative of privilege +description: This search looks for AWS CloudTrail events where a user A(victim A) + creates a login profile for user B, followed by a AWS Console login event from user + B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip search: '`cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName as new_login_profile | table src_ip eventName new_login_profile userName | join diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml index 1ff6a55b20..d4b5d20fbf 100644 --- a/detections/cloud/aws_excessive_security_scanning.yml +++ b/detections/cloud/aws_excessive_security_scanning.yml @@ -5,9 +5,9 @@ date: '2021-04-13' author: Patrick Bareiss, Splunk type: batch datamodel: [] -description: This search looks for AWS CloudTrail events and analyse the amount of eventNames - which starts with Describe by a single user. This indicates that this user scans - the configuration of your AWS cloud environment. +description: This search looks for AWS CloudTrail events and analyse the amount of + eventNames which starts with Describe by a single user. This indicates that this + user scans the configuration of your AWS cloud environment. search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* | stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(src) as src values(userAgent) as userAgent diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index d4a3534ada..c27a34643c 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -5,8 +5,8 @@ date: '2021-01-12' author: Bhavin Patel, Patrick Bareiss, Splunk type: batch datamodel: [] -description: This search looks for AWS CloudTrail events where a user has created an open/public - S3 bucket. +description: This search looks for AWS CloudTrail events where a user has created + an open/public S3 bucket. search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index b3c9baa886..d84e766b66 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -5,8 +5,8 @@ date: '2021-01-12' author: Patrick Bareiss, Splunk type: batch datamodel: [] -description: This search looks for AWS CloudTrail events where a user has created an open/public - S3 bucket over the aws cli. +description: This search looks for AWS CloudTrail events where a user has created + an open/public S3 bucket over the aws cli. search: '`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml b/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml index acce503890..0c34644c48 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml +++ b/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml @@ -5,9 +5,9 @@ date: '2020-07-21' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for AWS CloudTrail events where a user successfully launches - an abnormally high number of instances. This search is deprecated and have been - translated to use the latest Change Datamodel +description: This search looks for AWS CloudTrail events where a user successfully + launches an abnormally high number of instances. This search is deprecated and have + been translated to use the latest Change Datamodel search: '`cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m _time | stats count AS instances_launched by _time userName | eventstats avg(instances_launched) as total_launched_avg, stdev(instances_launched) as total_launched_stdev | eval diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml b/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml index 7eb4df52a8..78340ddb30 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml +++ b/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml @@ -5,9 +5,9 @@ date: '2020-07-21' author: Jason Brewer, Splunk type: batch datamodel: [] -description: This search looks for AWS CloudTrail events where a user successfully launches - an abnormally high number of instances. This search is deprecated and have been - translated to use the latest Change Datamodel. +description: This search looks for AWS CloudTrail events where a user successfully + launches an abnormally high number of instances. This search is deprecated and have + been translated to use the latest Change Datamodel. search: '`cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_aws_instances_launched_by_user___mltk_filter` | bucket span=10m _time | stats count as instances_launched by _time src_user | apply ec2_excessive_runinstances_v1 | rename "IsOutlier(instances_launched)" as diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml index 9207e45038..e219f028d5 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml +++ b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml @@ -5,9 +5,9 @@ date: '2020-07-21' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for AWS CloudTrail events where an abnormally high number - of instances were successfully terminated by a user in a 10-minute window. This - search is deprecated and have been translated to use the latest Change Datamodel. +description: This search looks for AWS CloudTrail events where an abnormally high + number of instances were successfully terminated by a user in a 10-minute window. + This search is deprecated and have been translated to use the latest Change Datamodel. search: '`cloudtrail` eventName=TerminateInstances errorCode=success | bucket span=10m _time | stats count AS instances_terminated by _time userName | eventstats avg(instances_terminated) as total_terminations_avg, stdev(instances_terminated) as total_terminations_stdev diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml index 165d25922b..8f57b5c17c 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml +++ b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml @@ -5,9 +5,9 @@ date: '2020-07-21' author: Jason Brewer, Splunk type: batch datamodel: [] -description: This search looks for AWS CloudTrail events where a user successfully terminates - an abnormally high number of instances. This search is deprecated and have been - translated to use the latest Change Datamodel. +description: This search looks for AWS CloudTrail events where a user successfully + terminates an abnormally high number of instances. This search is deprecated and + have been translated to use the latest Change Datamodel. search: '`cloudtrail` eventName=TerminateInstances errorCode=success `abnormally_high_aws_instances_terminated_by_user___mltk_filter` | bucket span=10m _time | stats count as instances_terminated by _time src_user | apply ec2_excessive_terminateinstances_v1 | rename "IsOutlier(instances_terminated)" diff --git a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml b/detections/deprecated/detect_api_activity_from_users_without_mfa.yml index e28002568e..fb341b9184 100644 --- a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml +++ b/detections/deprecated/detect_api_activity_from_users_without_mfa.yml @@ -5,8 +5,8 @@ date: '2018-05-17' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for AWS CloudTrail events where a user logged into the - AWS account, is making API calls and has not enabled Multi Factor authentication. +description: This search looks for AWS CloudTrail events where a user logged into + the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged diff --git a/detections/deprecated/detect_new_user_aws_console_login.yml b/detections/deprecated/detect_new_user_aws_console_login.yml index 7545c060ad..8e136b6837 100644 --- a/detections/deprecated/detect_new_user_aws_console_login.yml +++ b/detections/deprecated/detect_new_user_aws_console_login.yml @@ -18,10 +18,10 @@ search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | where userStatus ="First Time Logging into AWS Console" | `detect_new_user_aws_console_login_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail - inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to - create a baseline of previously seen IAM users within the last 30 days. Run "Update - previously seen users in AWS CloudTrail" hourly (or more frequently depending on how - often you run the detection searches) to refresh the baselines. + inputs. Run the "Previously seen users in AWS CloudTrail" support search only once + to create a baseline of previously seen IAM users within the last 30 days. Run "Update + previously seen users in AWS CloudTrail" hourly (or more frequently depending on + how often you run the detection searches) to refresh the baselines. known_false_positives: When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index 533c0df992..a05bc04179 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -28,14 +28,32 @@ tags: cis20: - CIS 6 - CIS 8 + confidence: 90 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: process $SourceImage$ injected into $TargetImage$ and was attempted dump + LSASS on $dest$. Adversaries tend to do this when trying to accesss credential + material stored in the process memory of the Local Security Authority Subsystem + Service (LSASS). mitre_attack_id: - T1003.001 nist: - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: TargetImage + type: Process + role: + - Target product: - Splunk Enterprise - Splunk Enterprise Security @@ -49,21 +67,5 @@ tags: - TargetProcessId - SourceImage - SourceProcessId - security_domain: endpoint - impact: 70 - confidence: 90 - # (impact * confidence)/100 risk_score: 63 - context: - - Source:Endpoint - - Stage:Credential Access - message: process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: TargetImage - type: Process - role: - - Target + security_domain: endpoint diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 41a2b336b0..932e6ea2d0 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -13,12 +13,12 @@ description: This detection targets behaviors observed when threat actors have u we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. search: '| tstats `security_content_summariesonly` distinct_count(Processes.process) - as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_id, - _time span=30m | where distinct_cmdlines >= 8 - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `excessive_number_of_service_control_start_as_disabled_filter`' + as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name + = "sc.exe" AND Processes.process="*start= disabled*" by Processes.dest Processes.user + Processes.parent_process Processes.process_name Processes.parent_process_id, _time + span=30m | where distinct_cmdlines >= 8 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_number_of_service_control_start_as_disabled_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete @@ -34,6 +34,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon.log kill_chain_phases: @@ -46,12 +47,11 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name - Processes.process - - Processes.process_id + - Processes.process_id - Processes.parent_process_id security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 7b07d6e85f..9ea5bf48c9 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -8,7 +8,8 @@ datamodel: - Endpoint description: 'The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified - during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ + during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. + \ Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, @@ -33,12 +34,27 @@ references: tags: analytic_story: - PrintNightmare CVE-2021-34527 + automated_detection_testing: passed + confidence: 90 + context: + - Source:Endpoint + - Stage:Persistence, + - Stage:Privilege Escalation + - Stage:Defense Evasion + - Scope:Incoming dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_operational.log + impact: 80 kill_chain_phases: - Exploitation + message: Suspicious print driver was loaded on endpoint $ComputerName$. mitre_attack_id: - T1547.012 + observable: + - name: ComputerName + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -49,20 +65,5 @@ tags: - EventCode - ComputerName - Message - security_domain: endpoint - impact: 80 - confidence: 90 risk_score: 72 - context: - - Source:Endpoint - - Stage:Persistence, - - Stage:Privilege Escalation - - Stage:Defense Evasion - - Scope:Incoming - message: Suspicious print driver was loaded on endpoint $ComputerName$. - observable: - - name: ComputerName - type: Endpoint - role: - - Victim - automated_detection_testing: passed + security_domain: endpoint diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 2bb02a1abc..2ed06e7632 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -6,32 +6,53 @@ author: Mauricio Velazco, Michael Haag, Splunk type: batch datamodel: - Endpoint -description: 'The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ - - Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ +description: 'The following analytic identifies driver load errors utilizing the Windows + PrintService Admin logs. This was identified during our testing of CVE-2021-34527 + previously (CVE-2021-1675) or PrintNightmare. \ + + Within the proof of concept code, the following error will occur - "The print spooler + failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, + error code 0x45A. See the event user data for context information." \ The analytic is based on file path and failure to load the plug-in. \ - During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events.' -search: '`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) - | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + During triage, isolate the endpoint and review for source of exploitation. Capture + any additional file modification events.' +search: '`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) + OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) + | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode + ComputerName Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `print_spooler_failed_to_load_a_plug_in_filter`' -how_to_implement: You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. +how_to_implement: You will need to ensure PrintService Admin and Operational logs + are being logged to Splunk from critical or all systems. known_false_positives: False positives are unknown and filtering may be required. references: - - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ - - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ - - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ +- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ +- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - PrintNightmare CVE-2021-34527 + confidence: 90 + context: + - Source:Endpoint + - Stage:Persistence, + - Stage:Privilege Escalation + - Stage:Defense Evasion + - Scope:Incoming dataset: [] + impact: 80 kill_chain_phases: - Exploitation + message: Suspicious printer spooler errors have occured on endpoint $ComputerName$ + with EventCode $EventCode$. mitre_attack_id: - T1547.012 + observable: + - name: ComputerName + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -42,20 +63,5 @@ tags: - EventCode - ComputerName - Message - security_domain: endpoint - impact: 80 - confidence: 90 - # (impact * confidence)/100 risk_score: 72 - context: - - Source:Endpoint - - Stage:Persistence, - - Stage:Privilege Escalation - - Stage:Defense Evasion - - Scope:Incoming - message: Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. - observable: - - name: ComputerName - type: Hostname - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index 71faff5d32..2e11089458 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -8,10 +8,10 @@ datamodel: - Endpoint description: The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified - during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal - behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint - and review for source of exploitation. Capture any additional file modification - events. + during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. + Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During + triage, isolate the endpoint and review for source of exploitation. Capture any + additional file modification events. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe Processes.process_name=rundll32.exe by Processes.dest Processes.user Processes.parent_process @@ -30,36 +30,22 @@ references: tags: analytic_story: - PrintNightmare CVE-2021-34527 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1547.012 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 80 + automated_detection_testing: passed confidence: 90 - risk_score: 72 context: - Source:Endpoint - Stage:Privilege Escalation - Stage:Defense Evasion - Scope:Local + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation message: $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare. + mitre_attack_id: + - T1547.012 observable: - name: dest type: Endpoint @@ -74,4 +60,18 @@ tags: type: Process role: - Child Process - automated_detection_testing: passed \ No newline at end of file + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index 1f4656418f..c12ec1beb5 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -11,8 +11,9 @@ description: This search is to detect suspicious loading of dll in specific path made by spoolsv.exe after the exploitation. search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) - as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer process_id EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `spoolsv_suspicious_loaded_modules_filter`' + as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer + process_id EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -22,31 +23,22 @@ references: tags: analytic_story: - PrintNightmare CVE-2021-34527 - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1547.012 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Image - - Computer - - EventCode - - ImageLoaded - security_domain: endpoint - impact: 80 + automated_detection_testing: passed confidence: 90 - risk_score: 72 context: - Source:Endpoint - Stage:Privilege Escalation - Stage:Defense Evasion - Scope:Local - message: $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. - This behavior is suspicious and related to PrintNightmare. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ + on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. + mitre_attack_id: + - T1547.012 observable: - name: Computer type: Endpoint @@ -61,6 +53,15 @@ tags: type: File role: - Other - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - Computer + - EventCode + - ImageLoaded + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index f19cfdcb05..13e1b1e906 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -7,10 +7,10 @@ type: batch datamodel: - Endpoint description: This analytic identifies a suspicious behavior related to PrintNightmare, - or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This - exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. - This detection is to look for suspicious process access made by the spoolsv.exe - that may related to the attack. + or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the + vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability + to elevate privilege. This detection is to look for suspicious process access made + by the spoolsv.exe that may related to the attack. search: '`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff | stats count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage @@ -29,31 +29,22 @@ references: tags: analytic_story: - PrintNightmare CVE-2021-34527 - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1068 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - SourceImage - - TargetImage - - GrantedAccess - - CallTrace - - EventCode - security_domain: endpoint - impact: 80 + automated_detection_testing: passed confidence: 90 - risk_score: 72 context: - Source:Endpoint - Stage:Privilege Escalation - Stage:Defense Evasion - Scope:Local - message: $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint + $Computer$. This behavior is suspicious and related to PrintNightmare. + mitre_attack_id: + - T1068 observable: - name: Computer type: Endpoint @@ -67,6 +58,16 @@ tags: type: Process Name role: - Target - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - GrantedAccess + - CallTrace + - EventCode + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index 32f0c01708..02152f87d4 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -7,11 +7,11 @@ type: batch datamodel: - Endpoint description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. - This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, - this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code - used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. - During triage, isolate the endpoint and review for source of exploitation. Capture - any additional file modification events. + This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) + or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write + a `.dll`. Current POC code used will write the suspicious DLL to disk within a path + of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source + of exploitation. Capture any additional file modification events. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=spoolsv.exe by _time Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| @@ -34,12 +34,34 @@ references: tags: analytic_story: - PrintNightmare CVE-2021-34527 + automated_detection_testing: passed + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + impact: 80 kill_chain_phases: - Exploitation + message: $process_name$ has been identified writing dll's to $file_path$ on endpoint + $dest$. This behavior is suspicious and related to PrintNightmare. mitre_attack_id: - T1547.012 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: process_id + type: Process + role: + - Process + - name: file_path + type: File + role: + - Other product: - Splunk Enterprise - Splunk Enterprise Security @@ -54,27 +76,5 @@ tags: - Processes.process_id - Processes.process_name - Processes.dest - security_domain: endpoint - impact: 80 - confidence: 90 risk_score: 72 - context: - - Source:Endpoint - - Stage:Privilege Escalation - - Stage:Defense Evasion - message: $process_name$ has been identified writing dll's to $file_path$ on endpoint - $dest$. This behavior is suspicious and related to PrintNightmare. - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: process_id - type: Process - role: - - Process - - name: file_path - type: File - role: - - Other - automated_detection_testing: passed + security_domain: endpoint diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index d08620f6d5..d18c48cf54 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -7,11 +7,11 @@ type: batch datamodel: - Endpoint description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. - This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, - this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code - used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. - During triage, isolate the endpoint and review for source of exploitation. Capture - any additional file modification events. + This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) + or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write + a `.dll`. Current POC code used will write the suspicious DLL to disk within a path + of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source + of exploitation. Capture any additional file modification events. search: '`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*" file_name=*.dll | stats count min(_time) as firstTime max(_time) as lastTime by dest, UserID, process_name, file_path, file_name, TargetFilename, process_id | `security_content_ctime(firstTime)` @@ -29,35 +29,22 @@ references: tags: analytic_story: - PrintNightmare CVE-2021-34527 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1547.012 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - dest - - UserID - - process_name - - file_path - - file_name - - TargetFilename - security_domain: endpoint - impact: 80 + automated_detection_testing: passed confidence: 90 - risk_score: 72 context: - Source:Endpoint - Stage:Privilege Escalation - Stage:Defense Evasion - Scope:Local + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation message: $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. + mitre_attack_id: + - T1547.012 observable: - name: dest type: Endpoint @@ -71,4 +58,17 @@ tags: type: File role: - Other - automated_detection_testing: passed + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - UserID + - process_name + - file_path + - file_name + - TargetFilename + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index 12b89f8652..fd7a4f7d52 100644 --- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -8,32 +8,34 @@ datamodel: - Endpoint description: This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT - tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection and prevent - access to their component files. -search: '| from read_ssa_enriched_events() - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), - process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), - parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) - | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true - AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), - ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' + tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection + and prevent access to their component files. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, + /(?i)deny/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -known_false_positives: network administrator may use this windows utility but this is not a common practice. +known_false_positives: network administrator may use this windows utility but this + is not a common practice. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig - kill_chain_phases: - - Exploitation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + kill_chain_phases: + - Exploitation mitre_attack_id: - T1222 product: @@ -46,4 +48,4 @@ tags: - process_path - dest_user_id - process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index d600f8b4fa..60bbb7e39e 100644 --- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -8,31 +8,34 @@ datamodel: - Endpoint description: This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT - tradecraft, ransomware and coinminer scripts to evade detections and restrict access to their - component files. -search: '| from read_ssa_enriched_events() - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), - process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), - parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) - | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true - AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), - ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' + tradecraft, ransomware and coinminer scripts to evade detections and restrict access + to their component files. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, + /(?i)grant/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR + process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -known_false_positives: network administrator may use this windows utility but this is not a common practice. +known_false_positives: network administrator may use this windows utility but this + is not a common practice. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig - kill_chain_phases: - - Exploitation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + kill_chain_phases: + - Exploitation mitre_attack_id: - T1222 product: @@ -45,4 +48,4 @@ tags: - process_path - dest_user_id - process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 488ae953ff..dd384c8f64 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -7,34 +7,38 @@ type: streaming datamodel: - Endpoint description: This analytic identifies suspicious modification of ACL permission to - a files or folder to make it available to everyone or to a specific user. This technique may be used by - the adversary to evade ACLs or protected files access. This changes is commonly - configured by the file or directory owner with appropriate permission. This behavior - is a good indicator if this command seen on a machine utilized by an account with - no permission to do so. -search: '| from read_ssa_enriched_events() - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), - process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), - parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) - | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) - AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' + a files or folder to make it available to everyone or to a specific user. This technique + may be used by the adversary to evade ACLs or protected files access. This changes + is commonly configured by the file or directory owner with appropriate permission. + This behavior is a good indicator if this command seen on a machine utilized by + an account with no permission to do so. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, + "%/G%") AND (match_regex(cmd_line, /(?i)everyone:/)=true OR match_regex(cmd_line, + /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" OR process_name="xcacls.exe" + OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. -known_false_positives: network administrator may use this windows utility. filter is needed. +known_false_positives: network administrator may use this windows utility. filter + is needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig - kill_chain_phases: - - Exploitation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + kill_chain_phases: + - Exploitation mitre_attack_id: - T1222 product: @@ -47,4 +51,4 @@ tags: - process_path - dest_user_id - process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index afc6927f78..ebf3548b14 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -7,17 +7,21 @@ type: streaming datamodel: - Endpoint description: The wevtutil.exe application is the windows event log utility. This searches - for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, - or system event logs. -search: '| from read_ssa_enriched_events() - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) - | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR - match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, /(?i)setup/)=true OR - match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' + for wevtutil.exe with parameters for clearing the application, security, setup, + powershell, sysmon, or system event logs. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, + "% cl %") AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, + /(?i)system/)=true OR match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line, + /(?i)application/)=true OR match_regex(cmd_line, /(?i)setup/)=true OR match_regex(cmd_line, + /(?i)powershell/)=true) AND process_name="wevtutil.exe" | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", + parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -32,10 +36,10 @@ tags: - Windows Log Manipulation - Ransomware - Clop Ransomware - kill_chain_phases: - - Exploitation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log + kill_chain_phases: + - Exploitation mitre_attack_id: - T1070.001 product: @@ -48,4 +52,4 @@ tags: - process_path - dest_user_id - process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index 8d8765ed13..ce8612550c 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -9,29 +9,34 @@ datamodel: description: This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections in compromised host. -search: '| from read_ssa_enriched_events() - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) - | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, + "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" | eval + start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -known_false_positives: network operator may disable audit event logs for debugging purposes. +known_false_positives: network operator may disable audit event logs for debugging + purposes. references: - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ tags: analytic_story: - Windows Log Manipulation - Ransomware - kill_chain_phases: - - Exploitation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + kill_chain_phases: + - Exploitation mitre_attack_id: - T1070.001 product: @@ -44,4 +49,4 @@ tags: - process_path - dest_user_id - process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index ee2ca2b383..da83ffc561 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -36,36 +36,21 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + impact: 50 kill_chain_phases: - Exploitation + message: suspicious mshta child process detected on host $dest$ by user $user$. mitre_attack_id: - T1218.005 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.dest - - Processes.parent_process - - Processes.user - security_domain: endpoint - impact: 50 - confidence: 80 - # (impact * confidence)/100 - risk_score: 40 - context: - - Source:Endpoint - - Stage:Execution - message: suspicious mshta child process detected on host $dest$ by user $user$. observable: - name: user type: User @@ -79,3 +64,17 @@ tags: type: Process Name role: - Parent Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.dest + - Processes.parent_process + - Processes.user + risk_score: 40 + security_domain: endpoint diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index df20b30d45..46948ce1bc 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.24.0" + "version": "3.25.0" }, "author": [ { diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 73302c0269..f5c0e890c1 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:37 UTC +# On Date: 2021-07-02T15:44:59 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -986,6 +986,28 @@ If behavioral searches included in this story yield positive hits, iDefense reco 1. 04d83cd3813698de28cfbba326d7647c product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] +[PrintNightmare CVE-2021-34527] +category = Lateral Movement +creation_date = 2021-07-01 +modification_date = 2021-07-01 +id = fd79470a-da88-11eb-b803-acde48001122 +version = 1 +reference = ["https://github.com/cube0x0/CVE-2021-1675/", "https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/", "https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/", "https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes"] +detection_searches = ["ESCU - Print Spooler Adding A Printer Driver - Rule", "ESCU - Print Spooler Failed to Load a Plug-in - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - Spoolsv Spawning Rundll32 - Rule", "ESCU - Spoolsv Suspicious Loaded Modules - Rule", "ESCU - Spoolsv Suspicious Process Access - Rule", "ESCU - Spoolsv Writing a DLL - Rule", "ESCU - Spoolsv Writing a DLL - Sysmon - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule"] +mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1068", "T1218.011", "T1547.012"], "nist": ["DE.CM", "PR.PT"]} +investigative_searches = [] +support_searches = [] +data_models = ["Endpoint"] +providing_technologies = none +description = The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. +narrative = This vulnerability affects the Print Spooler service, enabled by default on Windows systems, and allows adversaries to trick this service into installing a remotely hosted print driver using a low privileged user account. Successful exploitation effectively allows adversaries to execute code in the target system (Remote Code Execution) in the context of the Print Spooler service which runs with the highest privileges (Privilege Escalation). \ +The prerequisites for successful exploitation consist of: \ +1. Print Spooler service enabled on the target system \ +1. Network connectivity to the target system (initial access has been obtained) \ +1. Hash or password for a low privileged user ( or computer ) account. \ +In the most impactful scenario, an attacker would be able to leverage this vulnerability to obtain a SYSTEM shell on a domain controller and so escalate their privileges from a low privileged domain account to full domain access in the target environment as shown below. +product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] + [Prohibited Traffic Allowed or Protocol Mismatch] category = Best Practices creation_date = 2017-09-11 @@ -1632,7 +1654,7 @@ modification_date = 2018-05-31 id = 56e24a28-5003-4047-b2db-e8f3c4618064 version = 1 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"] -detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] +detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1222.001", "T1548.002", "T1562.001", "T1564.001"], "nist": ["DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 4dc5211918..a321aaef25 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:37 UTC +# On Date: 2021-07-02T15:44:59 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -686,6 +686,22 @@ If behavioral searches included in this story yield positive hits, iDefense reco 1. b8ec65dab97cdef3cd256cc4753f0c54\ 1. 04d83cd3813698de28cfbba326d7647c +[analytic_story://PrintNightmare CVE-2021-34527] +category = Lateral Movement +last_updated = 2021-07-01 +version = 1 +references = ["https://github.com/cube0x0/CVE-2021-1675/", "https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/", "https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/", "https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes"] +maintainers = [{"company": "no", "email": "-", "name": "Splunk Threat Research Team"}] +spec_version = 3 +searches = ["ESCU - Print Spooler Adding A Printer Driver - Rule", "ESCU - Print Spooler Failed to Load a Plug-in - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - Spoolsv Spawning Rundll32 - Rule", "ESCU - Spoolsv Suspicious Loaded Modules - Rule", "ESCU - Spoolsv Suspicious Process Access - Rule", "ESCU - Spoolsv Writing a DLL - Rule", "ESCU - Spoolsv Writing a DLL - Sysmon - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule"] +description = The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. +narrative = This vulnerability affects the Print Spooler service, enabled by default on Windows systems, and allows adversaries to trick this service into installing a remotely hosted print driver using a low privileged user account. Successful exploitation effectively allows adversaries to execute code in the target system (Remote Code Execution) in the context of the Print Spooler service which runs with the highest privileges (Privilege Escalation). \ +The prerequisites for successful exploitation consist of: \ +1. Print Spooler service enabled on the target system \ +1. Network connectivity to the target system (initial access has been obtained) \ +1. Hash or password for a low privileged user ( or computer ) account. \ +In the most impactful scenario, an attacker would be able to leverage this vulnerability to obtain a SYSTEM shell on a domain controller and so escalate their privileges from a low privileged domain account to full domain access in the target environment as shown below. + [analytic_story://Prohibited Traffic Allowed or Protocol Mismatch] category = Best Practices last_updated = 2017-09-11 @@ -1128,7 +1144,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1212,7 +1228,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new city is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your city, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. @@ -1223,7 +1239,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching over plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new country is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. @@ -1234,7 +1250,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. @@ -1245,7 +1261,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new region is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your region, there should be few false positives. If you are located in regions where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. @@ -1255,8 +1271,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user created a policy version that allows them to access any resource in their account -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources providing_technologies = [] @@ -1265,8 +1281,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. providing_technologies = [] @@ -1275,8 +1291,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user. providing_technologies = [] @@ -1296,7 +1312,7 @@ type = detection asset_type = AWS Account confidence = medium explanation = This search provides detection of KMS keys which action kms:Encrypt is accessible for everyone (also outside of your organization). This is an identicator that your account is compromised and the attacker uses the encryption key to compromise another company. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"mitre_attack": ["T1486"]} known_false_positives = unknown providing_technologies = [] @@ -1306,7 +1322,7 @@ type = detection asset_type = S3 Bucket confidence = medium explanation = This search provides detection of users with KMS keys performing encryption specifically against S3 buckets. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"mitre_attack": ["T1486"]} known_false_positives = bucket with S3 encryption providing_technologies = [] @@ -1325,8 +1341,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives. providing_technologies = [] @@ -1385,8 +1401,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail inputs. +explanation = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs. annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment. providing_technologies = [] @@ -1395,8 +1411,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that a user has legitimately deleted a network ACL. providing_technologies = [] @@ -1406,7 +1422,7 @@ type = detection asset_type = AWS Federated Account confidence = medium explanation = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"mitre_attack": ["T1078"]} known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. providing_technologies = [] @@ -1416,7 +1432,7 @@ type = detection asset_type = AWS Federated Account confidence = medium explanation = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"mitre_attack": ["T1078"]} known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. providing_technologies = [] @@ -1425,8 +1441,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources providing_technologies = [] @@ -1435,8 +1451,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. providing_technologies = [] @@ -1445,8 +1461,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment. +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. providing_technologies = [] @@ -1455,8 +1471,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment. +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. providing_technologies = [] @@ -1465,8 +1481,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured with your AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify whether this search alerted on a human user. providing_technologies = [] @@ -1475,8 +1491,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment. +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. providing_technologies = [] @@ -2171,8 +2187,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Leverage the support search `Create a list of approved AWS service accounts`: run it once every 30 days to create a list of service accounts and validate them.\ +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Leverage the support search `Create a list of approved AWS service accounts`: run it once every 30 days to create a list of service accounts and validate them.\ This search produces fields (`eventName`,`userIdentity.type`,`userIdentity.arn`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** eventName\ 1. \ 1. **Label:** AWS User ARN, **Field:** userIdentity.arn\ @@ -2197,8 +2213,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also populate the `identity_lookup_expanded` lookup shipped with the Asset and Identity framework to be able to look up users in your identity table in Enterprise Security (ES). Leverage the support search called "Create a list of approved AWS service accounts": run it once every 30 days to create and validate a list of service accounts.\ +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also populate the `identity_lookup_expanded` lookup shipped with the Asset and Identity framework to be able to look up users in your identity table in Enterprise Security (ES). Leverage the support search called "Create a list of approved AWS service accounts": run it once every 30 days to create and validate a list of service accounts.\ This search produces fields (`eventName`,`firstTime`,`lastTime`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** eventName\ 1. \ 1. **Label:** First Time, **Field:** firstTime\ @@ -2213,8 +2229,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -2223,8 +2239,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -2233,8 +2249,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -2243,8 +2259,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -2555,7 +2571,7 @@ providing_technologies = [] type = detection asset_type = S3 Bucket confidence = medium -explanation = This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. how_to_implement = annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. @@ -2565,7 +2581,7 @@ providing_technologies = [] type = detection asset_type = S3 Bucket confidence = medium -explanation = This search looks for CloudTrail events where a user has created an open/public S3 bucket. +explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. how_to_implement = You must install the AWS App for Splunk. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. @@ -2877,7 +2893,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect users creating spikes of API activity in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.\ +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.\ This search produces fields (`eventName`,`numberOfApiCalls`,`uniqueApisCalled`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** eventName\ 1. \ 1. **Label:** Number of API Calls, **Field:** numberOfApiCalls\ @@ -2913,7 +2929,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of Network ACL Activity by ARN" support search once to create a lookup file of previously seen Network ACL Activity. To add or remove API event names related to network ACLs, edit the macro `network_acl_events`. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of Network ACL Activity by ARN" support search once to create a lookup file of previously seen Network ACL Activity. To add or remove API event names related to network ACLs, edit the macro `network_acl_events`. annotations = {"cis20": ["CIS 12", "CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} known_false_positives = The false-positive rate may vary based on the values of`dataPointThreshold` and `deviationThreshold`. Please modify this according the your environment. providing_technologies = [] @@ -2923,7 +2939,7 @@ type = detection asset_type = S3 Bucket confidence = medium explanation = This search detects users creating spikes in API activity related to deletion of S3 buckets in your AWS environment. It will also update the cache file that factors in the latest data. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} known_false_positives = Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment. providing_technologies = [] @@ -2933,7 +2949,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.This search works best when you run the "Baseline of Security Group Activity by ARN" support search once to create a history of previously seen Security Group Activity. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.This search works best when you run the "Baseline of Security Group Activity by ARN" support search once to create a history of previously seen Security Group Activity. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} known_false_positives = Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment. providing_technologies = [] @@ -3094,7 +3110,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously seen API call per user roles in CloudTrail" support search once to create a history of previously seen user roles. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously seen API call per user roles in AWS CloudTrail" support search once to create a history of previously seen user roles. annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} known_false_positives = It is possible that there are legitimate user roles making new or infrequently used API calls in your infrastructure, causing the search to trigger. providing_technologies = [] @@ -3103,8 +3119,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Run the "Previously seen users in CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in AWS CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -3348,7 +3364,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being modified by users who have not previously modified them. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior. providing_technologies = [] @@ -3357,8 +3373,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Run the "Previously seen AWS Regions" support search only once to create of baseline of previously seen regions. This search is deprecated and have been translated to use the latest Change Datamodel. +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen AWS Regions" support search only once to create of baseline of previously seen regions. This search is deprecated and have been translated to use the latest Change Datamodel. annotations = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate. providing_technologies = [] @@ -3368,7 +3384,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 AMIs" support search once to create a history of previously seen AMIs. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 AMIs" support search once to create a history of previously seen AMIs. annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} known_false_positives = After a new AMI is created, the first systems created with that AMI will cause this alert to fire. Verify that the AMI being used was created by a legitimate user. providing_technologies = [] @@ -3378,7 +3394,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created with previously unseen instance types. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Instance Types" support search once to create a history of previously seen instance types. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Instance Types" support search once to create a history of previously seen instance types. annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} known_false_positives = It is possible that an admin will create a new system using a new instance type never used before. Verify with the creator that they intended to create the system with the new instance type. providing_technologies = [] @@ -3388,7 +3404,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} known_false_positives = It's possible that a user will start to create EC2 instances when they haven't before for any number of reasons. Verify with the user that is launching instances that this is the intended behavior. providing_technologies = [] @@ -3555,6 +3571,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} known_false_positives = Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. providing_technologies = [] +[savedsearch://ESCU - Excessive number of service control start as disabled - Rule] +type = detection +asset_type = +confidence = medium +explanation = This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. +how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +known_false_positives = Legitimate programs and administrators will execute sc.exe with the start disabled flag. It is possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time. +providing_technologies = [] + [savedsearch://ESCU - Excessive number of taskhost processes - Rule] type = detection asset_type = @@ -4328,7 +4354,7 @@ type = detection asset_type = AWS ECR container confidence = medium explanation = This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives. annotations = {"mitre_attack": ["T1525"]} known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. providing_technologies = [] @@ -4755,6 +4781,31 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} known_false_positives = Administrators may modify the boot configuration ignore failure during testing and debugging. providing_technologies = [] +[savedsearch://ESCU - Print Spooler Adding A Printer Driver - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began. +how_to_implement = You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +known_false_positives = Unknown. This may require filtering. +providing_technologies = [] + +[savedsearch://ESCU - Print Spooler Failed to Load a Plug-in - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ +The analytic is based on file path and failure to load the plug-in. \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +how_to_implement = You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +known_false_positives = False positives are unknown and filtering may be required. +providing_technologies = [] + [savedsearch://ESCU - Process Creating LNK file in Suspicious Location - Rule] type = detection asset_type = Endpoint @@ -5338,6 +5389,56 @@ annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Del known_false_positives = Retrieving server information may be a legitimate API request. Verify that the attempt is a valid request for information. providing_technologies = [] +[savedsearch://ESCU - Spoolsv Spawning Rundll32 - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +known_false_positives = Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver. +providing_technologies = [] + +[savedsearch://ESCU - Spoolsv Suspicious Loaded Modules - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - Spoolsv Suspicious Process Access - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made by the spoolsv.exe that may related to the attack. +how_to_implement = To successfully implement this search, you need to be ingesting logs with process access event where SourceImage, TargetImage, GrantedAccess and CallTrace executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of spoolsv.exe. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"]} +known_false_positives = Unknown. Filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Spoolsv Writing a DLL - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +known_false_positives = Unknown. +providing_technologies = [] + +[savedsearch://ESCU - Spoolsv Writing a DLL - Sysmon - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +known_false_positives = Limited false positives. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Start Up During Safe Mode Boot - Rule] type = detection asset_type = @@ -5791,7 +5892,7 @@ type = detection asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ -This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ +This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"]} @@ -6176,7 +6277,7 @@ type = detection asset_type = AWS Account confidence = medium explanation = This search provides detection of suspicious use of sts:AssumeRole. These tokens can be created on the go and used by attackers to move laterally and escalate privileges. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} known_false_positives = Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross account and cross resources access. This search can be adjusted to provide specific values to identify cases of abuse. providing_technologies = [] diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index 20b16a438c..09df733bcb 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 32018 +build = 32560 [triggers] reload.analytic_stories = simple @@ -19,7 +19,7 @@ reload.content-version = simple [launcher] author = Splunk -version = 3.24.0 +version = 3.25.0 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 166d906650..aec045c2f0 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:37 UTC +# On Date: 2021-07-02T15:44:59 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index e01cb50393..a2f4506a6a 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.24.0 +version = 3.25.0 diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index c74af767cd..db760d9656 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -349,6 +349,13 @@ disabled = 0 panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] +[panel_group://workbench_panel_group_printnightmare_cve_2021_34527] +label = PrintNightmare CVE-2021-34527 +description = The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] + [panel_group://workbench_panel_group_prohibited_traffic_allowed_or_protocol_mismatch] label = Prohibited Traffic Allowed or Protocol Mismatch description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 370f88d849..8b25a13fd2 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:37 UTC +# On Date: 2021-07-02T15:44:59 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -206,6 +206,10 @@ description = Use this macro to determine how far back you should be checking fo definition = "-70m@m" description = Use this macro to determine how far back you should be checking for new provisioning activities +[printservice] +definition = source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin" +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [prohibited_apps_launching_cmd] definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name description = This macro outputs a list of process that should not be the parent process of cmd.exe @@ -1203,6 +1207,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[excessive_number_of_service_control_start_as_disabled_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [excessive_number_of_taskhost_processes_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1667,6 +1675,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[print_spooler_adding_a_printer_driver_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[print_spooler_failed_to_load_a_plug_in_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [process_creating_lnk_file_in_suspicious_location_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1899,6 +1915,26 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[spoolsv_spawning_rundll32_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_suspicious_loaded_modules_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_suspicious_process_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_writing_a_dll_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_writing_a_dll___sysmon_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [start_up_during_safe_mode_boot_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 5023f706da..15b39e64fa 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:37 UTC +# On Date: 2021-07-02T15:44:59 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ description = WARNING, this detection has been marked deprecated by the Splunk T action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} action.escu.data_models = [] action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new city is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your city, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. action.escu.creation_date = 2018-03-16 @@ -63,7 +63,7 @@ description = WARNING, this detection has been marked deprecated by the Splunk T action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} action.escu.data_models = [] action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching over plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new country is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. action.escu.creation_date = 2018-03-16 @@ -105,7 +105,7 @@ description = WARNING, this detection has been marked deprecated by the Splunk T action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} action.escu.data_models = [] action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. action.escu.creation_date = 2018-03-16 @@ -147,7 +147,7 @@ description = WARNING, this detection has been marked deprecated by the Splunk T action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} action.escu.data_models = [] action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new region is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your region, there should be few false positives. If you are located in regions where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. action.escu.creation_date = 2018-03-16 @@ -185,11 +185,11 @@ search = `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI [ESCU - AWS Create Policy Version to allow all resources - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user created a policy version that allows them to access any resource in their account +description = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user created a policy version that allows them to access any resource in their account -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources action.escu.creation_date = 2021-02-22 action.escu.modification_date = 2021-02-22 @@ -227,11 +227,11 @@ search = `cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws. [ESCU - AWS CreateAccessKey - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +description = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. action.escu.creation_date = 2021-03-02 action.escu.modification_date = 2021-03-02 @@ -269,11 +269,11 @@ search = `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws. [ESCU - AWS CreateLoginProfile - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip +description = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user. action.escu.creation_date = 2021-03-02 action.escu.modification_date = 2021-03-02 @@ -357,7 +357,7 @@ description = This search provides detection of KMS keys which action kms:Encryp action.escu.mappings = {"mitre_attack": ["T1486"]} action.escu.data_models = [] action.escu.eli5 = This search provides detection of KMS keys which action kms:Encrypt is accessible for everyone (also outside of your organization). This is an identicator that your account is compromised and the attacker uses the encryption key to compromise another company. -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs action.escu.known_false_positives = unknown action.escu.creation_date = 2021-01-11 action.escu.modification_date = 2021-01-11 @@ -399,7 +399,7 @@ description = This search provides detection of users with KMS keys performing e action.escu.mappings = {"mitre_attack": ["T1486"]} action.escu.data_models = [] action.escu.eli5 = This search provides detection of users with KMS keys performing encryption specifically against S3 buckets. -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs action.escu.known_false_positives = bucket with S3 encryption action.escu.creation_date = 2021-01-11 action.escu.modification_date = 2021-01-11 @@ -477,11 +477,11 @@ search = `aws_cloudwatchlogs_eks` objectRef.resource=secrets OR configmaps sourc [ESCU - AWS Excessive Security Scanning - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. +description = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.eli5 = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives. action.escu.creation_date = 2021-04-13 action.escu.modification_date = 2021-04-13 @@ -729,11 +729,11 @@ search = `cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorC [ESCU - AWS Network Access Control List Created with All Open Ports - Rule] action.escu = 0 action.escu.enabled = 1 -description = The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. +description = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] -action.escu.eli5 = The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail inputs. +action.escu.eli5 = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs. action.escu.known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment. action.escu.creation_date = 2021-01-11 action.escu.modification_date = 2021-01-11 @@ -771,11 +771,11 @@ search = `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor [ESCU - AWS Network Access Control List Deleted - Rule] action.escu = 0 action.escu.enabled = 1 -description = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs. +description = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] -action.escu.eli5 = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +action.escu.eli5 = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. action.escu.known_false_positives = It's possible that a user has legitimately deleted a network ACL. action.escu.creation_date = 2021-01-12 action.escu.modification_date = 2021-01-12 @@ -817,7 +817,7 @@ description = This search provides specific SAML access from specific Service Pr action.escu.mappings = {"mitre_attack": ["T1078"]} action.escu.data_models = [] action.escu.eli5 = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs action.escu.known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. action.escu.creation_date = 2021-01-26 action.escu.modification_date = 2021-01-26 @@ -859,7 +859,7 @@ description = This search provides detection of updates to SAML provider in AWS. action.escu.mappings = {"mitre_attack": ["T1078"]} action.escu.data_models = [] action.escu.eli5 = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. action.escu.creation_date = 2021-01-26 action.escu.modification_date = 2021-01-26 @@ -897,11 +897,11 @@ search = `cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as f [ESCU - AWS SetDefaultPolicyVersion - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy +description = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources action.escu.creation_date = 2021-03-02 action.escu.modification_date = 2021-03-02 @@ -939,11 +939,11 @@ search = `cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazon [ESCU - AWS UpdateLoginProfile - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +description = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. action.escu.creation_date = 2021-03-02 action.escu.modification_date = 2021-03-02 @@ -981,11 +981,11 @@ search = `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazona [ESCU - Abnormally High AWS Instances Launched by User - Rule] action.escu = 0 action.escu.enabled = 1 -description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] -action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment. +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 @@ -1010,7 +1010,7 @@ action.correlationsearch.label = ESCU - Deprecated - Abnormally High AWS Instanc action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel +action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel action.notable.param.rule_title = Abnormally High AWS Instances Launched by User action.notable.param.security_domain = network action.notable.param.severity = high @@ -1028,11 +1028,11 @@ search = `cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m [ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule] action.escu = 0 action.escu.enabled = 1 -description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] -action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment. +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 @@ -1058,7 +1058,7 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", " schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. +action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. action.notable.param.rule_title = Abnormally High AWS Instances Launched by User - MLTK action.notable.param.security_domain = network action.notable.param.severity = high @@ -1076,11 +1076,11 @@ search = `cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_ [ESCU - Abnormally High AWS Instances Terminated by User - Rule] action.escu = 0 action.escu.enabled = 1 -description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] -action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. action.escu.known_false_positives = Many service accounts configured with your AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify whether this search alerted on a human user. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 @@ -1098,7 +1098,7 @@ action.correlationsearch.label = ESCU - Deprecated - Abnormally High AWS Instanc action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. +action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. action.notable.param.rule_title = Abnormally High AWS Instances Terminated by User action.notable.param.security_domain = network action.notable.param.severity = high @@ -1116,11 +1116,11 @@ search = `cloudtrail` eventName=TerminateInstances errorCode=success | bucket sp [ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule] action.escu = 0 action.escu.enabled = 1 -description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] -action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment. +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 @@ -1139,7 +1139,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS EC2 A schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. +action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. action.notable.param.rule_title = Abnormally High AWS Instances Terminated by User - MLTK action.notable.param.security_domain = network action.notable.param.severity = high @@ -3915,11 +3915,11 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces [ESCU - Detect API activity from users without MFA - Rule] action.escu = 0 action.escu.enabled = 1 -description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users. +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users. action.escu.mappings = {"cis20": ["CIS 16"], "nist": ["DE.DP", "PR.AC"]} action.escu.data_models = [] -action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Leverage the support search `Create a list of approved AWS service accounts`: run it once every 30 days to create a list of service accounts and validate them.\ +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Leverage the support search `Create a list of approved AWS service accounts`: run it once every 30 days to create a list of service accounts and validate them.\ This search produces fields (`eventName`,`userIdentity.type`,`userIdentity.arn`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** eventName\ 1. \ 1. **Label:** AWS User ARN, **Field:** userIdentity.arn\ @@ -3951,7 +3951,7 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring" schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users. +action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users. action.notable.param.rule_title = Detect API activity from users without MFA action.notable.param.security_domain = network action.notable.param.severity = high @@ -4010,11 +4010,11 @@ search = `cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="ar [ESCU - Detect AWS API Activities From Unapproved Accounts - Rule] action.escu = 0 action.escu.enabled = 1 -description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard. +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard. action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC", "ID.AM"]} action.escu.data_models = [] -action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also populate the `identity_lookup_expanded` lookup shipped with the Asset and Identity framework to be able to look up users in your identity table in Enterprise Security (ES). Leverage the support search called "Create a list of approved AWS service accounts": run it once every 30 days to create and validate a list of service accounts.\ +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also populate the `identity_lookup_expanded` lookup shipped with the Asset and Identity framework to be able to look up users in your identity table in Enterprise Security (ES). Leverage the support search called "Create a list of approved AWS service accounts": run it once every 30 days to create and validate a list of service accounts.\ This search produces fields (`eventName`,`firstTime`,`lastTime`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** eventName\ 1. \ 1. **Label:** First Time, **Field:** firstTime\ @@ -4046,7 +4046,7 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring" schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard. +action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard. action.notable.param.rule_title = Detect AWS API Activities From Unapproved Accounts action.notable.param.security_domain = access action.notable.param.severity = high @@ -4064,11 +4064,11 @@ search = `cloudtrail` errorCode=success | rename userName as identity | search N [ESCU - Detect AWS Console Login by New User - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = ["Authentication"] -action.escu.eli5 = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. +action.escu.eli5 = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. action.escu.creation_date = 2020-05-28 action.escu.modification_date = 2020-05-28 @@ -4106,11 +4106,11 @@ search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from da [ESCU - Detect AWS Console Login by User from New City - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = ["Authentication"] -action.escu.eli5 = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. +action.escu.eli5 = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. action.escu.creation_date = 2020-10-07 action.escu.modification_date = 2020-10-07 @@ -4148,11 +4148,11 @@ search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from da [ESCU - Detect AWS Console Login by User from New Country - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = ["Authentication"] -action.escu.eli5 = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. +action.escu.eli5 = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. action.escu.creation_date = 2020-10-07 action.escu.modification_date = 2020-10-07 @@ -4190,11 +4190,11 @@ search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from da [ESCU - Detect AWS Console Login by User from New Region - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = ["Authentication"] -action.escu.eli5 = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. +action.escu.eli5 = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. action.escu.creation_date = 2020-10-07 action.escu.modification_date = 2020-10-07 @@ -5431,10 +5431,10 @@ search = `google_gcp_pubsub_message` data.resource.type=gcs_bucket data.protoPay [ESCU - Detect New Open S3 Buckets over AWS CLI - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. action.escu.how_to_implement = action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. action.escu.creation_date = 2021-01-12 @@ -5473,10 +5473,10 @@ search = `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR r [ESCU - Detect New Open S3 buckets - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user has created an open/public S3 bucket. +description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user has created an open/public S3 bucket. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. action.escu.how_to_implement = You must install the AWS App for Splunk. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. action.escu.creation_date = 2021-01-12 @@ -6755,7 +6755,7 @@ description = WARNING, this detection has been marked deprecated by the Splunk T action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} action.escu.data_models = [] action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect users creating spikes of API activity in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.\ +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.\ This search produces fields (`eventName`,`numberOfApiCalls`,`uniqueApisCalled`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** eventName\ 1. \ 1. **Label:** Number of API Calls, **Field:** numberOfApiCalls\ @@ -6892,7 +6892,7 @@ description = WARNING, this detection has been marked deprecated by the Splunk T action.escu.mappings = {"cis20": ["CIS 12", "CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} action.escu.data_models = [] action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of Network ACL Activity by ARN" support search once to create a lookup file of previously seen Network ACL Activity. To add or remove API event names related to network ACLs, edit the macro `network_acl_events`. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of Network ACL Activity by ARN" support search once to create a lookup file of previously seen Network ACL Activity. To add or remove API event names related to network ACLs, edit the macro `network_acl_events`. action.escu.known_false_positives = The false-positive rate may vary based on the values of`dataPointThreshold` and `deviationThreshold`. Please modify this according the your environment. action.escu.creation_date = 2018-05-21 action.escu.modification_date = 2018-05-21 @@ -6940,7 +6940,7 @@ description = This search detects users creating spikes in API activity related action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} action.escu.data_models = [] action.escu.eli5 = This search detects users creating spikes in API activity related to deletion of S3 buckets in your AWS environment. It will also update the cache file that factors in the latest data. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity. action.escu.known_false_positives = Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment. action.escu.creation_date = 2018-11-27 action.escu.modification_date = 2018-11-27 @@ -6988,7 +6988,7 @@ description = WARNING, this detection has been marked deprecated by the Splunk T action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} action.escu.data_models = [] action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.This search works best when you run the "Baseline of Security Group Activity by ARN" support search once to create a history of previously seen Security Group Activity. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.This search works best when you run the "Baseline of Security Group Activity by ARN" support search once to create a history of previously seen Security Group Activity. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. action.escu.known_false_positives = Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment. action.escu.creation_date = 2018-04-18 action.escu.modification_date = 2018-04-18 @@ -7630,7 +7630,7 @@ description = WARNING, this detection has been marked deprecated by the Splunk T action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} action.escu.data_models = [] action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously seen API call per user roles in CloudTrail" support search once to create a history of previously seen user roles. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously seen API call per user roles in AWS CloudTrail" support search once to create a history of previously seen user roles. action.escu.known_false_positives = It is possible that there are legitimate user roles making new or infrequently used API calls in your infrastructure, causing the search to trigger. action.escu.creation_date = 2018-04-16 action.escu.modification_date = 2018-04-16 @@ -7674,11 +7674,11 @@ search = `cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=A [ESCU - Detect new user AWS Console Login - Rule] action.escu = 0 action.escu.enabled = 1 -description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] -action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Run the "Previously seen users in CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in AWS CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 @@ -7697,7 +7697,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. +action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. action.notable.param.rule_title = Detect new user AWS Console Login action.notable.param.security_domain = network action.notable.param.severity = high @@ -8669,7 +8669,7 @@ description = WARNING, this detection has been marked deprecated by the Splunk T action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} action.escu.data_models = [] action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being modified by users who have not previously modified them. This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. action.escu.known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 @@ -8713,11 +8713,11 @@ search = `cloudtrail` `ec2_modification_api_calls` [search `cloudtrail` `ec2_mod [ESCU - EC2 Instance Started In Previously Unseen Region - Rule] action.escu = 0 action.escu.enabled = 1 -description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started action.escu.mappings = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] -action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Run the "Previously seen AWS Regions" support search only once to create of baseline of previously seen regions. This search is deprecated and have been translated to use the latest Change Datamodel. +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen AWS Regions" support search only once to create of baseline of previously seen regions. This search is deprecated and have been translated to use the latest Change Datamodel. action.escu.known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate. action.escu.creation_date = 2018-02-23 action.escu.modification_date = 2018-02-23 @@ -8742,7 +8742,7 @@ action.correlationsearch.label = ESCU - Deprecated - EC2 Instance Started In Pre action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started +action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started action.notable.param.rule_title = EC2 Instance Started In Previously Unseen Region action.notable.param.security_domain = network action.notable.param.severity = high @@ -8764,7 +8764,7 @@ description = WARNING, this detection has been marked deprecated by the Splunk T action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} action.escu.data_models = [] action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 AMIs" support search once to create a history of previously seen AMIs. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 AMIs" support search once to create a history of previously seen AMIs. action.escu.known_false_positives = After a new AMI is created, the first systems created with that AMI will cause this alert to fire. Verify that the AMI being used was created by a legitimate user. action.escu.creation_date = 2018-03-12 action.escu.modification_date = 2018-03-12 @@ -8804,7 +8804,7 @@ description = WARNING, this detection has been marked deprecated by the Splunk T action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} action.escu.data_models = [] action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created with previously unseen instance types. This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Instance Types" support search once to create a history of previously seen instance types. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Instance Types" support search once to create a history of previously seen instance types. action.escu.known_false_positives = It is possible that an admin will create a new system using a new instance type never used before. Verify with the creator that they intended to create the system with the new instance type. action.escu.creation_date = 2020-02-07 action.escu.modification_date = 2020-02-07 @@ -8845,7 +8845,7 @@ description = WARNING, this detection has been marked deprecated by the Splunk T action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} action.escu.data_models = [] action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the latest Change Datamodel. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. action.escu.known_false_positives = It's possible that a user will start to create EC2 instances when they haven't before for any number of reasons. Verify with the user that is launching instances that this is the intended behavior. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 @@ -9532,6 +9532,47 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Processes.process) as process distinct_count(Processes.process) as distinct_process_count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m | where distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter` +[ESCU - Excessive number of service control start as disabled - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.data_models = [] +action.escu.eli5 = This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. +action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. +action.escu.known_false_positives = Legitimate programs and administrators will execute sc.exe with the start disabled flag. It is possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time. +action.escu.creation_date = 2021-06-25 +action.escu.modification_date = 2021-06-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Excessive number of service control start as disabled - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Excessive number of service control start as disabled - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. +action.notable.param.rule_title = Excessive number of service control start as disabled +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` distinct_count(Processes.process) as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_id, _time span=30m | where distinct_cmdlines >= 8 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_service_control_start_as_disabled_filter` + [ESCU - Excessive number of taskhost processes - Rule] action.escu = 0 action.escu.enabled = 1 @@ -12621,7 +12662,7 @@ description = This searches show information on uploaded containers including so action.escu.mappings = {"mitre_attack": ["T1525"]} action.escu.data_models = [] action.escu.eli5 = This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives. action.escu.known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. action.escu.creation_date = 2020-02-20 action.escu.modification_date = 2020-02-20 @@ -14367,6 +14408,115 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "bcdedit.exe" Processes.process = "*bootstatuspolicy*" Processes.process = "*ignoreallfailures*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `prevent_automatic_repair_mode_using_bcdedit_filter` +[ESCU - Print Spooler Adding A Printer Driver - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began. +action.escu.how_to_implement = You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. +action.escu.known_false_positives = Unknown. This may require filtering. +action.escu.creation_date = 2021-07-01 +action.escu.modification_date = 2021-07-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Print Spooler Adding A Printer Driver - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = Suspicious print driver was loaded on endpoint $ComputerName$. +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 72}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Print Spooler Adding A Printer Driver - Rule +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began. +action.notable.param.rule_title = Print Spooler Adding A Printer Driver +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `printservice` EventCode=316 category = "Adding a printer driver" Message = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `print_spooler_adding_a_printer_driver_filter` + +[ESCU - Print Spooler Failed to Load a Plug-in - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ +The analytic is based on file path and failure to load the plug-in. \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ +The analytic is based on file path and failure to load the plug-in. \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +action.escu.how_to_implement = You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. +action.escu.known_false_positives = False positives are unknown and filtering may be required. +action.escu.creation_date = 2021-07-01 +action.escu.modification_date = 2021-07-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Print Spooler Failed to Load a Plug-in - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 72}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Print Spooler Failed to Load a Plug-in - Rule +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ +The analytic is based on file path and failure to load the plug-in. \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +action.notable.param.rule_title = Print Spooler Failed to Load a Plug-in +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `print_spooler_failed_to_load_a_plug_in_filter` + [ESCU - Process Creating LNK file in Suspicious Location - Rule] action.escu = 0 action.escu.enabled = 1 @@ -15566,13 +15716,13 @@ action.escu.full_search_name = ESCU - Rundll32 with no Command Line Arguments wi action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike"] +action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 with no Command Line Arguments with Network - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -16738,6 +16888,243 @@ realtime_schedule = 0 is_visible = false search = index=_internal sourcetype=splunkd_ui_access server-info | search clientip!=127.0.0.1 uri_path="*raw/services/server/info/server-info" | rename clientip as src_ip, splunk_server as dest | stats earliest(_time) as firstTime, latest(_time) as lastTime, values(uri) as uri, values(useragent) as http_user_agent, values(user) as user by src_ip, dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_information_disclosure_filter` +[ESCU - Spoolsv Spawning Rundll32 - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver. +action.escu.creation_date = 2021-07-01 +action.escu.modification_date = 2021-07-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Spoolsv Spawning Rundll32 - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_id", "threat_object_type": "process"}, {"threat_object_field": "process_id", "threat_object_type": "process"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Spoolsv Spawning Rundll32 - Rule +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +action.notable.param.rule_title = Spoolsv Spawning Rundll32 +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe Processes.process_name=rundll32.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_spawning_rundll32_filter` + +[ESCU - Spoolsv Suspicious Loaded Modules - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +action.escu.data_models = [] +action.escu.eli5 = This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-07-01 +action.escu.modification_date = 2021-07-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Spoolsv Suspicious Loaded Modules - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_id", "threat_object_type": "process name"}, {"threat_object_field": "ImageLoaded", "threat_object_type": "file"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Spoolsv Suspicious Loaded Modules - Rule +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Parent Process", "Attacker"], "type": "Process Name"}, {"name": "ImageLoaded", "role": ["Other"], "type": "File"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. +action.notable.param.rule_title = Spoolsv Suspicious Loaded Modules +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer process_id EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter` + +[ESCU - Spoolsv Suspicious Process Access - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made by the spoolsv.exe that may related to the attack. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made by the spoolsv.exe that may related to the attack. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with process access event where SourceImage, TargetImage, GrantedAccess and CallTrace executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of spoolsv.exe. +action.escu.known_false_positives = Unknown. Filter as needed. +action.escu.creation_date = 2021-07-01 +action.escu.modification_date = 2021-07-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Spoolsv Suspicious Process Access - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "ProcessID", "threat_object_type": "process"}, {"threat_object_field": "TargetImage", "threat_object_type": "process name"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Spoolsv Suspicious Process Access - Rule +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ProcessID", "role": ["Parent Process"], "type": "Process"}, {"name": "TargetImage", "role": ["Target"], "type": "Process Name"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made by the spoolsv.exe that may related to the attack. +action.notable.param.rule_title = Spoolsv Suspicious Process Access +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff | stats count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage TargetImage GrantedAccess CallTrace EventCode ProcessID| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_process_access_filter` + +[ESCU - Spoolsv Writing a DLL - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. +action.escu.known_false_positives = Unknown. +action.escu.creation_date = 2021-07-01 +action.escu.modification_date = 2021-07-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Spoolsv Writing a DLL - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_path", "threat_object_type": "file"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Spoolsv Writing a DLL - Rule +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +action.notable.param.rule_title = Spoolsv Writing a DLL +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=spoolsv.exe by _time Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*" Filesystem.file_name="*.dll" by _time Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] | dedup file_create_time | table dest file_create_time, file_name, file_path, process_name | `spoolsv_writing_a_dll_filter` + +[ESCU - Spoolsv Writing a DLL - Sysmon - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +action.escu.known_false_positives = Limited false positives. Filter as needed. +action.escu.creation_date = 2021-07-01 +action.escu.modification_date = 2021-07-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Spoolsv Writing a DLL - Sysmon - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_path", "threat_object_type": "file"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Spoolsv Writing a DLL - Sysmon - Rule +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +action.notable.param.rule_title = Spoolsv Writing a DLL - Sysmon +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*" file_name=*.dll | stats count min(_time) as firstTime max(_time) as lastTime by dest, UserID, process_name, file_path, file_name, TargetFilename, process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_writing_a_dll___sysmon_filter` + [ESCU - Start Up During Safe Mode Boot - Rule] action.escu = 0 action.escu.enabled = 1 @@ -17738,13 +18125,13 @@ action.escu.full_search_name = ESCU - Suspicious Rundll32 no Command Line Argume action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike"] +action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -18556,12 +18943,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ -This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ +This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ -This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ +This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. action.escu.known_false_positives = Potential for some third party applications to disable AMSI upon invocation. Filter as needed. @@ -18582,7 +18969,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ -This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ +This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.notable.param.rule_title = Unloading AMSI via Reflection action.notable.param.security_domain = endpoint @@ -20106,7 +20493,7 @@ description = This search provides detection of suspicious use of sts:AssumeRole action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} action.escu.data_models = [] action.escu.eli5 = This search provides detection of suspicious use of sts:AssumeRole. These tokens can be created on the go and used by attackers to move laterally and escalate privileges. -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs action.escu.known_false_positives = Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross account and cross resources access. This search can be adjusted to provide specific values to identify cases of abuse. action.escu.creation_date = 2020-07-27 action.escu.modification_date = 2020-07-27 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 3c366ecf55..77113becb4 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:37 UTC +# On Date: 2021-07-02T15:44:59 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index 4dc5211918..a321aaef25 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:37 UTC +# On Date: 2021-07-02T15:44:59 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -686,6 +686,22 @@ If behavioral searches included in this story yield positive hits, iDefense reco 1. b8ec65dab97cdef3cd256cc4753f0c54\ 1. 04d83cd3813698de28cfbba326d7647c +[analytic_story://PrintNightmare CVE-2021-34527] +category = Lateral Movement +last_updated = 2021-07-01 +version = 1 +references = ["https://github.com/cube0x0/CVE-2021-1675/", "https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/", "https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/", "https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes"] +maintainers = [{"company": "no", "email": "-", "name": "Splunk Threat Research Team"}] +spec_version = 3 +searches = ["ESCU - Print Spooler Adding A Printer Driver - Rule", "ESCU - Print Spooler Failed to Load a Plug-in - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - Spoolsv Spawning Rundll32 - Rule", "ESCU - Spoolsv Suspicious Loaded Modules - Rule", "ESCU - Spoolsv Suspicious Process Access - Rule", "ESCU - Spoolsv Writing a DLL - Rule", "ESCU - Spoolsv Writing a DLL - Sysmon - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule"] +description = The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. +narrative = This vulnerability affects the Print Spooler service, enabled by default on Windows systems, and allows adversaries to trick this service into installing a remotely hosted print driver using a low privileged user account. Successful exploitation effectively allows adversaries to execute code in the target system (Remote Code Execution) in the context of the Print Spooler service which runs with the highest privileges (Privilege Escalation). \ +The prerequisites for successful exploitation consist of: \ +1. Print Spooler service enabled on the target system \ +1. Network connectivity to the target system (initial access has been obtained) \ +1. Hash or password for a low privileged user ( or computer ) account. \ +In the most impactful scenario, an attacker would be able to leverage this vulnerability to obtain a SYSTEM shell on a domain controller and so escalate their privileges from a low privileged domain account to full domain access in the target environment as shown below. + [analytic_story://Prohibited Traffic Allowed or Protocol Mismatch] category = Best Practices last_updated = 2017-09-11 @@ -1128,7 +1144,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1212,7 +1228,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new city is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your city, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. @@ -1223,7 +1239,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching over plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new country is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. @@ -1234,7 +1250,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. @@ -1245,7 +1261,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new region is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your region, there should be few false positives. If you are located in regions where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. @@ -1255,8 +1271,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user created a policy version that allows them to access any resource in their account -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources providing_technologies = [] @@ -1265,8 +1281,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. providing_technologies = [] @@ -1275,8 +1291,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user. providing_technologies = [] @@ -1296,7 +1312,7 @@ type = detection asset_type = AWS Account confidence = medium explanation = This search provides detection of KMS keys which action kms:Encrypt is accessible for everyone (also outside of your organization). This is an identicator that your account is compromised and the attacker uses the encryption key to compromise another company. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"mitre_attack": ["T1486"]} known_false_positives = unknown providing_technologies = [] @@ -1306,7 +1322,7 @@ type = detection asset_type = S3 Bucket confidence = medium explanation = This search provides detection of users with KMS keys performing encryption specifically against S3 buckets. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"mitre_attack": ["T1486"]} known_false_positives = bucket with S3 encryption providing_technologies = [] @@ -1325,8 +1341,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives. providing_technologies = [] @@ -1385,8 +1401,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail inputs. +explanation = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs. annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment. providing_technologies = [] @@ -1395,8 +1411,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that a user has legitimately deleted a network ACL. providing_technologies = [] @@ -1406,7 +1422,7 @@ type = detection asset_type = AWS Federated Account confidence = medium explanation = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"mitre_attack": ["T1078"]} known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. providing_technologies = [] @@ -1416,7 +1432,7 @@ type = detection asset_type = AWS Federated Account confidence = medium explanation = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"mitre_attack": ["T1078"]} known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. providing_technologies = [] @@ -1425,8 +1441,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources providing_technologies = [] @@ -1435,8 +1451,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. providing_technologies = [] @@ -1445,8 +1461,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment. +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. providing_technologies = [] @@ -1455,8 +1471,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment. +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. providing_technologies = [] @@ -1465,8 +1481,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured with your AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify whether this search alerted on a human user. providing_technologies = [] @@ -1475,8 +1491,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment. +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. providing_technologies = [] @@ -2171,8 +2187,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Leverage the support search `Create a list of approved AWS service accounts`: run it once every 30 days to create a list of service accounts and validate them.\ +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Leverage the support search `Create a list of approved AWS service accounts`: run it once every 30 days to create a list of service accounts and validate them.\ This search produces fields (`eventName`,`userIdentity.type`,`userIdentity.arn`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** eventName\ 1. \ 1. **Label:** AWS User ARN, **Field:** userIdentity.arn\ @@ -2197,8 +2213,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also populate the `identity_lookup_expanded` lookup shipped with the Asset and Identity framework to be able to look up users in your identity table in Enterprise Security (ES). Leverage the support search called "Create a list of approved AWS service accounts": run it once every 30 days to create and validate a list of service accounts.\ +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also populate the `identity_lookup_expanded` lookup shipped with the Asset and Identity framework to be able to look up users in your identity table in Enterprise Security (ES). Leverage the support search called "Create a list of approved AWS service accounts": run it once every 30 days to create and validate a list of service accounts.\ This search produces fields (`eventName`,`firstTime`,`lastTime`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** eventName\ 1. \ 1. **Label:** First Time, **Field:** firstTime\ @@ -2213,8 +2229,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -2223,8 +2239,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -2233,8 +2249,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -2243,8 +2259,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -2555,7 +2571,7 @@ providing_technologies = [] type = detection asset_type = S3 Bucket confidence = medium -explanation = This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. how_to_implement = annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. @@ -2565,7 +2581,7 @@ providing_technologies = [] type = detection asset_type = S3 Bucket confidence = medium -explanation = This search looks for CloudTrail events where a user has created an open/public S3 bucket. +explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. how_to_implement = You must install the AWS App for Splunk. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. @@ -2877,7 +2893,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect users creating spikes of API activity in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.\ +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.\ This search produces fields (`eventName`,`numberOfApiCalls`,`uniqueApisCalled`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** eventName\ 1. \ 1. **Label:** Number of API Calls, **Field:** numberOfApiCalls\ @@ -2913,7 +2929,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of Network ACL Activity by ARN" support search once to create a lookup file of previously seen Network ACL Activity. To add or remove API event names related to network ACLs, edit the macro `network_acl_events`. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of Network ACL Activity by ARN" support search once to create a lookup file of previously seen Network ACL Activity. To add or remove API event names related to network ACLs, edit the macro `network_acl_events`. annotations = {"cis20": ["CIS 12", "CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} known_false_positives = The false-positive rate may vary based on the values of`dataPointThreshold` and `deviationThreshold`. Please modify this according the your environment. providing_technologies = [] @@ -2923,7 +2939,7 @@ type = detection asset_type = S3 Bucket confidence = medium explanation = This search detects users creating spikes in API activity related to deletion of S3 buckets in your AWS environment. It will also update the cache file that factors in the latest data. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} known_false_positives = Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment. providing_technologies = [] @@ -2933,7 +2949,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.This search works best when you run the "Baseline of Security Group Activity by ARN" support search once to create a history of previously seen Security Group Activity. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.This search works best when you run the "Baseline of Security Group Activity by ARN" support search once to create a history of previously seen Security Group Activity. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} known_false_positives = Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment. providing_technologies = [] @@ -3094,7 +3110,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously seen API call per user roles in CloudTrail" support search once to create a history of previously seen user roles. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously seen API call per user roles in AWS CloudTrail" support search once to create a history of previously seen user roles. annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} known_false_positives = It is possible that there are legitimate user roles making new or infrequently used API calls in your infrastructure, causing the search to trigger. providing_technologies = [] @@ -3103,8 +3119,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Run the "Previously seen users in CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in AWS CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -3348,7 +3364,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being modified by users who have not previously modified them. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior. providing_technologies = [] @@ -3357,8 +3373,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Run the "Previously seen AWS Regions" support search only once to create of baseline of previously seen regions. This search is deprecated and have been translated to use the latest Change Datamodel. +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen AWS Regions" support search only once to create of baseline of previously seen regions. This search is deprecated and have been translated to use the latest Change Datamodel. annotations = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate. providing_technologies = [] @@ -3368,7 +3384,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 AMIs" support search once to create a history of previously seen AMIs. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 AMIs" support search once to create a history of previously seen AMIs. annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} known_false_positives = After a new AMI is created, the first systems created with that AMI will cause this alert to fire. Verify that the AMI being used was created by a legitimate user. providing_technologies = [] @@ -3378,7 +3394,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created with previously unseen instance types. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Instance Types" support search once to create a history of previously seen instance types. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Instance Types" support search once to create a history of previously seen instance types. annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} known_false_positives = It is possible that an admin will create a new system using a new instance type never used before. Verify with the creator that they intended to create the system with the new instance type. providing_technologies = [] @@ -3388,7 +3404,7 @@ type = detection asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the latest Change Datamodel. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} known_false_positives = It's possible that a user will start to create EC2 instances when they haven't before for any number of reasons. Verify with the user that is launching instances that this is the intended behavior. providing_technologies = [] @@ -3555,6 +3571,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} known_false_positives = Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. providing_technologies = [] +[savedsearch://ESCU - Excessive number of service control start as disabled - Rule] +type = detection +asset_type = +confidence = medium +explanation = This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. +how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +known_false_positives = Legitimate programs and administrators will execute sc.exe with the start disabled flag. It is possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time. +providing_technologies = [] + [savedsearch://ESCU - Excessive number of taskhost processes - Rule] type = detection asset_type = @@ -4328,7 +4354,7 @@ type = detection asset_type = AWS ECR container confidence = medium explanation = This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives. annotations = {"mitre_attack": ["T1525"]} known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. providing_technologies = [] @@ -4755,6 +4781,31 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} known_false_positives = Administrators may modify the boot configuration ignore failure during testing and debugging. providing_technologies = [] +[savedsearch://ESCU - Print Spooler Adding A Printer Driver - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began. +how_to_implement = You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +known_false_positives = Unknown. This may require filtering. +providing_technologies = [] + +[savedsearch://ESCU - Print Spooler Failed to Load a Plug-in - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ +The analytic is based on file path and failure to load the plug-in. \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +how_to_implement = You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +known_false_positives = False positives are unknown and filtering may be required. +providing_technologies = [] + [savedsearch://ESCU - Process Creating LNK file in Suspicious Location - Rule] type = detection asset_type = Endpoint @@ -5338,6 +5389,56 @@ annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Del known_false_positives = Retrieving server information may be a legitimate API request. Verify that the attempt is a valid request for information. providing_technologies = [] +[savedsearch://ESCU - Spoolsv Spawning Rundll32 - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +known_false_positives = Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver. +providing_technologies = [] + +[savedsearch://ESCU - Spoolsv Suspicious Loaded Modules - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - Spoolsv Suspicious Process Access - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made by the spoolsv.exe that may related to the attack. +how_to_implement = To successfully implement this search, you need to be ingesting logs with process access event where SourceImage, TargetImage, GrantedAccess and CallTrace executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of spoolsv.exe. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"]} +known_false_positives = Unknown. Filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Spoolsv Writing a DLL - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +known_false_positives = Unknown. +providing_technologies = [] + +[savedsearch://ESCU - Spoolsv Writing a DLL - Sysmon - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +known_false_positives = Limited false positives. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Start Up During Safe Mode Boot - Rule] type = detection asset_type = @@ -5791,7 +5892,7 @@ type = detection asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ -This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ +This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"]} @@ -6176,7 +6277,7 @@ type = detection asset_type = AWS Account confidence = medium explanation = This search provides detection of suspicious use of sts:AssumeRole. These tokens can be created on the go and used by attackers to move laterally and escalate privileges. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} known_false_positives = Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross account and cross resources access. This search can be adjusted to provide specific values to identify cases of abuse. providing_technologies = [] diff --git a/dist/escu/lookups/mitre_enrichment.csv b/dist/escu/lookups/mitre_enrichment.csv index b7c4ecb5a6..0717cbc6ba 100644 --- a/dist/escu/lookups/mitre_enrichment.csv +++ b/dist/escu/lookups/mitre_enrichment.csv @@ -1,182 +1,59 @@ mitre_id,technique,tactics,groups -T1553.006,Code Signing Policy Modification,Defense Evasion,Turla|APT39 -T1614,System Location Discovery,Discovery,no -T1613,Container and Resource Discovery,Discovery,no -T1552.007,Container API,Credential Access,no -T1612,Build Image on Host,Defense Evasion,no -T1611,Escape to Host,Privilege Escalation,no -T1204.003,Malicious Image,Execution,no -T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation,no -T1610,Deploy Container,Defense Evasion|Execution,no -T1609,Container Administration Command,Execution,no -T1608.005,Link Target,Resource Development,Silent Librarian -T1608.004,Drive-by Target,Resource Development,APT32|Threat Group-3390 -T1608.003,Install Digital Certificate,Resource Development,no -T1608.002,Upload Tool,Resource Development,Threat Group-3390 -T1608.001,Upload Malware,Resource Development,APT32 -T1608,Stage Capabilities,Resource Development,no -T1016.001,Internet Connection Discovery,Discovery,APT29|UNC2452|Turla -T1553.005,Mark-of-the-Web Bypass,Defense Evasion,TA505 -T1555.005,Password Managers,Credential Access,Fox Kitten|Operation Wocao -T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29|UNC2452 -T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Indrik Spider -T1547.014,Active Setup,Persistence|Privilege Escalation,no -T1606.002,SAML Tokens,Credential Access,APT29|UNC2452 -T1606.001,Web Cookies,Credential Access,APT29|UNC2452 -T1606,Forge Web Credentials,Credential Access,no -T1555.004,Windows Credential Manager,Credential Access,Stealth Falcon|OilRig|Turla -T1059.008,Network Device CLI,Execution,no -T1602.002,Network Device Configuration Dump,Collection,no -T1542.005,TFTP Boot,Defense Evasion|Persistence,no -T1542.004,ROMMONkit,Defense Evasion|Persistence,no -T1602.001,SNMP (MIB Dump),Collection,no -T1602,Data from Configuration Repository,Collection,no -T1601.002,Downgrade System Image,Defense Evasion,no -T1601.001,Patch System Image,Defense Evasion,no -T1601,Modify System Image,Defense Evasion,no -T1600.002,Disable Crypto Hardware,Defense Evasion,no -T1600.001,Reduce Key Space,Defense Evasion,no -T1600,Weaken Encryption,Defense Evasion,no -T1556.004,Network Device Authentication,Credential Access|Defense Evasion|Persistence,no -T1599.001,Network Address Translation Traversal,Defense Evasion,no -T1599,Network Boundary Bridging,Defense Evasion,no -T1020.001,Traffic Duplication,Exfiltration,no -T1557.002,ARP Cache Poisoning,Credential Access|Collection,Cleaver -T1588.006,Vulnerabilities,Resource Development,Sandworm Team -T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no -T1562.008,Disable Cloud Logs,Defense Evasion,no -T1547.012,Print Processors,Persistence|Privilege Escalation,no -T1598.003,Spearphishing Link,Reconnaissance,Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky -T1598.002,Spearphishing Attachment,Reconnaissance,Sidewinder -T1598.001,Spearphishing Service,Reconnaissance,no -T1598,Phishing for Information,Reconnaissance,ZIRCONIUM|APT28 -T1597.002,Purchase Technical Data,Reconnaissance,no -T1597.001,Threat Intel Vendors,Reconnaissance,no -T1597,Search Closed Sources,Reconnaissance,no -T1596.005,Scan Databases,Reconnaissance,no -T1596.004,CDNs,Reconnaissance,no -T1596.003,Digital Certificates,Reconnaissance,no -T1596.001,DNS/Passive DNS,Reconnaissance,no -T1596.002,WHOIS,Reconnaissance,no -T1596,Search Open Technical Databases,Reconnaissance,no -T1595.002,Vulnerability Scanning,Reconnaissance,Volatile Cedar|APT28|Sandworm Team -T1595.001,Scanning IP Blocks,Reconnaissance,no -T1595,Active Scanning,Reconnaissance,no -T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Sandworm Team -T1593.002,Search Engines,Reconnaissance,no -T1593.001,Social Media,Reconnaissance,no -T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team -T1592.004,Client Configurations,Reconnaissance,HAFNIUM -T1592.003,Firmware,Reconnaissance,no -T1592.002,Software,Reconnaissance,Sandworm Team -T1592.001,Hardware,Reconnaissance,no -T1592,Gather Victim Host Information,Reconnaissance,no -T1591.004,Identify Roles,Reconnaissance,no -T1591.003,Identify Business Tempo,Reconnaissance,no -T1591.001,Determine Physical Locations,Reconnaissance,no -T1591.002,Business Relationships,Reconnaissance,Sandworm Team -T1591,Gather Victim Org Information,Reconnaissance,no -T1590.006,Network Security Appliances,Reconnaissance,no -T1590.005,IP Addresses,Reconnaissance,HAFNIUM -T1590.004,Network Topology,Reconnaissance,no -T1590.003,Network Trust Dependencies,Reconnaissance,no -T1590.002,DNS,Reconnaissance,no -T1590.001,Domain Properties,Reconnaissance,Sandworm Team -T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM -T1589.003,Employee Names,Reconnaissance,Silent Librarian|Sandworm Team -T1589.002,Email Addresses,Reconnaissance,TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team -T1589.001,Credentials,Reconnaissance,APT28|Magic Hound|Chimera -T1589,Gather Victim Identity Information,Reconnaissance,APT32 -T1588.005,Exploits,Resource Development,no -T1588.004,Digital Certificates,Resource Development,Lazarus Group|Silent Librarian -T1588.003,Code Signing Certificates,Resource Development,Wizard Spider -T1588.002,Tool,Resource Development,MuddyWater|Silent Librarian|GALLIUM|Sandworm Team -T1588.001,Malware,Resource Development,Turla|APT1 -T1588,Obtain Capabilities,Resource Development,no -T1587.004,Exploits,Resource Development,no -T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM -T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork -T1587.001,Malware,Resource Development,APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver -T1587,Develop Capabilities,Resource Development,Kimsuky -T1586.002,Email Accounts,Resource Development,Magic Hound|Kimsuky -T1586.001,Social Media Accounts,Resource Development,no -T1586,Compromise Accounts,Resource Development,no -T1585.002,Email Accounts,Resource Development,Magic Hound|Silent Librarian|Sandworm Team|APT1 -T1585.001,Social Media Accounts,Resource Development,Fox Kitten|Sandworm Team|APT32|Cleaver -T1585,Establish Accounts,Resource Development,Fox Kitten|APT17 -T1584.006,Web Services,Resource Development,Turla -T1584.005,Botnet,Resource Development,no -T1584.004,Server,Resource Development,Indrik Spider|Turla|APT16 -T1584.003,Virtual Private Server,Resource Development,Turla -T1584.002,DNS Server,Resource Development,no -T1584.001,Domains,Resource Development,APT29|UNC2452|APT1 -T1583.006,Web Services,Resource Development,ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29 -T1583.005,Botnet,Resource Development,no -T1583.004,Server,Resource Development,GALLIUM|Sandworm Team -T1583.003,Virtual Private Server,Resource Development,HAFNIUM|TEMP.Veles -T1583.002,DNS Server,Resource Development,no -T1584,Compromise Infrastructure,Resource Development,no -T1583.001,Domains,Resource Development,APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28 -T1583,Acquire Infrastructure,Resource Development,no -T1564.007,VBA Stomping,Defense Evasion,no -T1558.004,AS-REP Roasting,Credential Access,no -T1580,Cloud Infrastructure Discovery,Discovery,no -T1218.012,Verclsid,Defense Evasion,no -T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,PROMETHIUM +T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,no T1564.006,Run Virtual Instance,Defense Evasion,no T1564.005,Hidden File System,Defense Evasion,Strider|Equation -T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion|Persistence,no +T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion,no T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Mockingbird T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no T1098.004,SSH Authorized Keys,Persistence,no T1480.001,Environmental Keying,Defense Evasion,APT41|Equation -T1059.007,JavaScript,Execution,MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer +T1059.007,JavaScript/JScript,Execution,APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer T1578.004,Revert Cloud Instance,Defense Evasion,no T1578.003,Delete Cloud Instance,Defense Evasion,no T1578.001,Create Snapshot,Defense Evasion,no T1578.002,Create Cloud Instance,Defense Evasion,no T1127.001,MSBuild,Defense Evasion,Frankenstein -T1027.005,Indicator Removal from Tools,Defense Evasion,Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda +T1027.005,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda T1562.006,Indicator Blocking,Defense Evasion,no -T1573.002,Asymmetric Cryptography,Command And Control,Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 -T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group +T1573.002,Asymmetric Cryptography,Command And Control,Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 +T1573.001,Symmetric Cryptography,Command And Control,Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group T1573,Encrypted Channel,Command And Control,Tropic Trooper T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28 -T1071.004,DNS,Command And Control,Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 -T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28 -T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee -T1071.001,Web Protocols,Command And Control,APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|APT19|Cobalt Group|Rancor|Orangeworm|Threat Group-3390|Ke3chang|Turla|APT37|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|Magic Hound|OilRig|Gamaredon Group|Stealth Falcon -T1572,Protocol Tunneling,Command And Control,Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6 -T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group -T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT29|UNC2452 +T1071.004,DNS,Command And Control,APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 +T1071.003,Mail Protocols,Command And Control,APT32|SilverTerrier|APT28 +T1071.002,File Transfer Protocols,Command And Control,APT41|SilverTerrier|Machete|Honeybee +T1071.001,Web Protocols,Command And Control,Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon +T1572,Protocol Tunneling,Command And Control,OilRig|Cobalt Group|FIN6 +T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group +T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,no T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no -T1001.003,Protocol Impersonation,Command And Control,Higaisa|Lazarus Group -T1001.002,Steganography,Command And Control,APT29|Axiom +T1001.003,Protocol Impersonation,Command And Control,Lazarus Group +T1001.002,Steganography,Command And Control,Axiom T1001.001,Junk Data,Command And Control,APT28 T1132.002,Non-Standard Encoding,Command And Control,no -T1132.001,Standard Encoding,Command And Control,HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork +T1132.001,Standard Encoding,Command And Control,Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork T1090.004,Domain Fronting,Command And Control,APT29 -T1090.003,Multi-hop Proxy,Command And Control,APT28|Operation Wocao|Inception|FIN4|APT29 -T1090.002,External Proxy,Command And Control,APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 -T1090.001,Internal Proxy,Command And Control,APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider +T1090.003,Multi-hop Proxy,Command And Control,Inception|FIN4|APT29 +T1090.002,External Proxy,Command And Control,APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 +T1090.001,Internal Proxy,Command And Control,APT39|Strider T1102.003,One-Way Communication,Command And Control,Leviathan -T1102.002,Bidirectional Communication,Command And Control,ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak +T1102.002,Bidirectional Communication,Command And Control,Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 -T1074.002,Remote Data Staging,Collection,APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 -T1074.001,Local Data Staging,Collection,Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 +T1074.002,Remote Data Staging,Collection,Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 +T1074.001,Local Data Staging,Collection,Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28 T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT33 T1564.004,NTFS File Attributes,Defense Evasion,APT32 -T1564.003,Hidden Window,Defense Evasion,Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound -T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32 -T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314 +T1564.003,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound +T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Tropic Trooper|FIN10|Stolen Pencil|APT32 +T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,TA505|APT3|Threat Group-1314 T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no T1564.002,Hidden Users,Defense Evasion,no -T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke -T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 -T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass +T1574.006,LD_PRELOAD,Persistence|Privilege Escalation|Defense Evasion,Rocke +T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 +T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Whitefly|RTM|Threat Group-3390|menuPass T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no @@ -184,174 +61,174 @@ T1574.011,Services Registry Permissions Weakness,Persistence|Privilege Escalatio T1574.005,Executable Installer File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no T1574.010,Services File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no -T1069.001,Local Groups,Discovery,Chimera|Operation Wocao|Turla|OilRig|admin@338 -T1570,Lateral Tool Transfer,Lateral Movement,Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10 +T1069.001,Local Groups,Discovery,Turla|OilRig|admin@338 +T1570,Lateral Tool Transfer,Lateral Movement,APT32|Wizard Spider|Turla|FIN10 T1568.003,DNS Calculation,Command And Control,APT12 -T1204.002,Malicious File,Execution,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|BRONZE BUTLER|FIN7|Dragonfly 2.0|APT19|Dark Caracal|Cobalt Group|Gorgon Group|Patchwork|MuddyWater|DarkHydrus|OilRig|APT32|Rancor|Lazarus Group|APT29|APT28|APT37|FIN8|Elderwood|menuPass|PLATINUM|TA459|Leviathan -T1204.001,Malicious Link,Execution,APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla +T1204.002,Malicious File,Execution,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM +T1204.001,Malicious Link,Execution,Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla T1195.003,Compromise Hardware Supply Chain,Initial Access,no -T1195.002,Compromise Software Supply Chain,Initial Access,APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 +T1195.002,Compromise Software Supply Chain,Initial Access,Sandworm Team|APT41 T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no -T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505 -T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper -T1569.002,Service Execution,Execution,Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang +T1568.001,Fast Flux DNS,Command And Control,TA505 +T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper +T1569.002,Service Execution,Execution,Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang T1569.001,Launchctl,Execution,no T1569,System Services,Execution,no -T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41 -T1568,Dynamic Resolution,Command And Control,APT29|UNC2452 +T1568.002,Domain Generation Algorithms,Command And Control,APT41 +T1568,Dynamic Resolution,Command And Control,no T1011.001,Exfiltration Over Bluetooth,Exfiltration,no -T1567.002,Exfiltration to Cloud Storage,Exfiltration,ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla +T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Turla T1567.001,Exfiltration to Code Repository,Exfiltration,no -T1059.006,Python,Execution,ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete -T1059.005,Visual Basic,Execution,Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound +T1059.006,Python,Execution,Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete +T1059.005,Visual Basic,Execution,APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound T1059.004,Unix Shell,Execution,Rocke|APT41 -T1059.003,Windows Command Shell,Execution,APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Rancor|Ke3chang|Dragonfly 2.0|Leviathan|APT37|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|menuPass|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 +T1059.003,Windows Command Shell,Execution,TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1 T1059.002,AppleScript,Execution,no -T1059.001,PowerShell,Execution,Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|Dragonfly 2.0|APT28|Thrip|Cobalt Group|DarkHydrus|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|Magic Hound|CopyKittens|OilRig|BRONZE BUTLER|FIN10|Threat Group-3390|APT32|FIN7|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda -T1567,Exfiltration Over Web Service,Exfiltration,APT28 +T1059.001,PowerShell,Execution,Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda +T1567,Exfiltration Over Web Service,Exfiltration,no T1497.003,Time Based Evasion,Defense Evasion|Discovery,no -T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7 -T1497.001,System Checks,Defense Evasion|Discovery,Darkhotel|Evilnum|Frankenstein +T1497.002,User Activity Based Checks,Defense Evasion|Discovery,FIN7 +T1497.001,System Checks,Defense Evasion|Discovery,Frankenstein T1498.002,Reflection Amplification,Impact,no T1498.001,Direct Network Flood,Impact,no -T1566.003,Spearphishing via Service,Initial Access,Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal -T1566.002,Spearphishing Link,Initial Access,Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT33|APT29|Leviathan|Elderwood|FIN8|Patchwork|Magic Hound -T1566.001,Spearphishing Attachment,Initial Access,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|APT19|Lazarus Group|OilRig|APT32|BRONZE BUTLER|Dragonfly 2.0|MuddyWater|APT28|FIN8|TA459|Elderwood|APT29|Leviathan|Patchwork|APT37|menuPass|PLATINUM -T1566,Phishing,Initial Access,GOLD SOUTHFIELD|Dragonfly +T1566.003,Spearphishing via Service,Initial Access,Magic Hound|Windshift|FIN6|OilRig|Dark Caracal +T1566.002,Spearphishing Link,Initial Access,Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8 +T1566.001,Spearphishing Attachment,Initial Access,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass +T1566,Phishing,Initial Access,no T1565.003,Runtime Data Manipulation,Impact,APT38 T1565.002,Transmitted Data Manipulation,Impact,APT38 T1565.001,Stored Data Manipulation,Impact,FIN4|APT38 T1565,Data Manipulation,Impact,no -T1564.001,Hidden Files and Directories,Defense Evasion,Mustang Panda|Rocke|APT32|Tropic Trooper|Lazarus Group|APT28 +T1564.001,Hidden Files and Directories,Defense Evasion,Rocke|APT32|Tropic Trooper|APT28|Lazarus Group T1564,Hide Artifacts,Defense Evasion,no T1563.002,RDP Hijacking,Lateral Movement,no T1563.001,SSH Hijacking,Lateral Movement,no T1563,Remote Service Session Hijacking,Lateral Movement,no -T1518.001,Security Software Discovery,Discovery,Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon +T1518.001,Security Software Discovery,Discovery,Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon T1069.003,Cloud Groups,Discovery,no -T1069.002,Domain Groups,Discovery,Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang +T1069.002,Domain Groups,Discovery,Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang T1087.004,Cloud Account,Discovery,no T1087.003,Email Account,Discovery,Sandworm Team|TA505 -T1087.002,Domain Account,Discovery,MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|BRONZE BUTLER|OilRig|menuPass|FIN6|Poseidon Group|Ke3chang -T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 +T1087.002,Domain Account,Discovery,Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang +T1087.001,Local Account,Discovery,Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 T1553.004,Install Root Certificate,Defense Evasion,no -T1562.004,Disable or Modify System Firewall,Defense Evasion,APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak -T1562.003,Impair Command History Logging,Defense Evasion,no -T1562.002,Disable Windows Event Logging,Defense Evasion,APT29|UNC2452|Threat Group-3390 -T1562.001,Disable or Modify Tools,Defense Evasion,APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda +T1562.004,Disable or Modify System Firewall,Defense Evasion,Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak +T1562.003,HISTCONTROL,Defense Evasion,no +T1562.002,Disable Windows Event Logging,Defense Evasion,Threat Group-3390 +T1562.001,Disable or Modify Tools,Defense Evasion,Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda T1562,Impair Defenses,Defense Evasion,no T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33 T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37 T1561.001,Disk Content Wipe,Impact,Lazarus Group T1561,Disk Wipe,Impact,no -T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6 +T1560.003,Archive via Custom Method,Collection,Lazarus Group|Kimsuky|CopyKittens|FIN6 T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390 -T1560.001,Archive via Utility,Collection,APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang +T1560.001,Archive via Utility,Collection,APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang T1560,Archive Collected Data,Collection,menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang T1499.004,Application or System Exploitation,Impact,no T1499.003,Application Exhaustion Flood,Impact,no T1499.002,Service Exhaustion Flood,Impact,no T1499.001,OS Exhaustion Flood,Impact,no -T1491.002,External Defacement,Impact,Sandworm Team +T1491.002,External Defacement,Impact,no T1491.001,Internal Defacement,Impact,Lazarus Group -T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky -T1114.002,Remote Email Collection,Collection,APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang -T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1 +T1114.003,Email Forwarding Rule,Collection,no +T1114.002,Remote Email Collection,Collection,APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer +T1114.001,Local Email Collection,Collection,Magic Hound|APT1 T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,no T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|Lazarus Group T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28 -T1213.002,Sharepoint,Collection,Chimera|Ke3chang|APT28 +T1213.002,Sharepoint,Collection,Ke3chang|APT28 T1213.001,Confluence,Collection,no -T1555.003,Credentials from Web Browsers,Credential Access,Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats +T1555.003,Credentials from Web Browsers,Credential Access,Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats T1555.002,Securityd Memory,Credential Access,no T1555.001,Keychain,Credential Access,no -T1559.002,Dynamic Data Exchange,Execution,Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 +T1559.002,Dynamic Data Exchange,Execution,Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater T1559,Inter-Process Communication,Execution,no T1558.002,Silver Ticket,Credential Access,no T1558.001,Golden Ticket,Credential Access,Ke3chang T1558,Steal or Forge Kerberos Tickets,Credential Access,no -T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Wizard Spider -T1557,Man-in-the-Middle,Credential Access|Collection,Kimsuky -T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider -T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera -T1556,Modify Authentication Process,Credential Access|Defense Evasion|Persistence,no +T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,no +T1557,Man-in-the-Middle,Credential Access|Collection,no +T1556.002,Password Filter DLL,Credential Access|Defense Evasion,Strider +T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion,no +T1556,Modify Authentication Process,Credential Access|Defense Evasion,no T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM T1056.003,Web Portal Capture,Collection|Credential Access,no T1056.002,GUI Input Capture,Collection|Credential Access,FIN4 -T1056.001,Keylogging,Collection|Credential Access,Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 -T1555,Credentials from Password Stores,Credential Access,APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon +T1056.001,Keylogging,Collection|Credential Access,APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 +T1555,Credentials from Password Stores,Credential Access,APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon T1552.005,Cloud Instance Metadata API,Credential Access,no T1003.008,/etc/passwd and /etc/shadow,Credential Access,no T1003.007,Proc Filesystem,Credential Access,no -T1003.006,DCSync,Credential Access,APT29|UNC2452|Operation Wocao -T1558.003,Kerberoasting,Credential Access,APT29|UNC2452|Operation Wocao|Wizard Spider +T1003.006,DCSync,Credential Access,no +T1558.003,Kerberoasting,Credential Access,no T1552.006,Group Policy Preferences,Credential Access,APT33 -T1003.003,NTDS,Credential Access,Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 -T1003.002,Security Account Manager,Credential Access,Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass -T1003.001,LSASS Memory,Credential Access,HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|MuddyWater|PLATINUM|FIN8|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver -T1110.004,Credential Stuffing,Credential Access,Chimera -T1110.003,Password Spraying,Credential Access,Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group -T1110.002,Password Cracking,Credential Access,FIN6|APT41|Dragonfly 2.0|APT3 -T1110.001,Password Guessing,Credential Access,APT28 -T1021.006,Windows Remote Management,Lateral Movement,APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390 -T1021.005,VNC,Lateral Movement,Fox Kitten|GCMAN -T1021.004,SSH,Lateral Movement,Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN +T1003.003,NTDS,Credential Access,FIN6|Dragonfly 2.0 +T1003.002,Security Account Manager,Credential Access,Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass +T1003.001,LSASS Memory,Credential Access,Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver +T1110.004,Credential Stuffing,Credential Access,no +T1110.003,Password Spraying,Credential Access,APT33|Leafminer|Lazarus Group +T1110.002,Password Cracking,Credential Access,APT41|Dragonfly 2.0|APT3 +T1110.001,Password Guessing,Credential Access,no +T1021.006,Windows Remote Management,Lateral Movement,Threat Group-3390 +T1021.005,VNC,Lateral Movement,GCMAN +T1021.004,SSH,Lateral Movement,Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN T1021.003,Distributed Component Object Model,Lateral Movement,no -T1021.002,SMB/Windows Admin Shares,Lateral Movement,Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang -T1021.001,Remote Desktop Protocol,Lateral Movement,Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom +T1021.002,SMB/Windows Admin Shares,Lateral Movement,Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang +T1021.001,Remote Desktop Protocol,Lateral Movement,Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom T1554,Compromise Client Software Binary,Persistence,no T1036.006,Space after Filename,Defense Evasion,no -T1036.005,Match Legitimate Name or Location,Defense Evasion,APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 -T1036.004,Masquerade Task or Service,Defense Evasion,ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 -T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|GALLIUM +T1036.005,Match Legitimate Name or Location,Defense Evasion,Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 +T1036.004,Masquerade Task or Service,Defense Evasion,Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 +T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|Soft Cell|PLATINUM T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic -T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37 +T1036.001,Invalid Code Signature,Defense Evasion,Windshift T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no -T1553.002,Code Signing,Defense Evasion,APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel +T1553.002,Code Signing,Defense Evasion,Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel T1553.001,Gatekeeper Bypass,Defense Evasion,no T1553,Subvert Trust Controls,Defense Evasion,no -T1027.003,Steganography,Defense Evasion,TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 -T1027.002,Software Packing,Defense Evasion,ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon -T1027.001,Binary Padding,Defense Evasion,Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee +T1027.003,Steganography,Defense Evasion,BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 +T1027.002,Software Packing,Defense Evasion,TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon +T1027.001,Binary Padding,Defense Evasion,Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,Rocke|APT32 -T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider -T1552.004,Private Keys,Credential Access,APT29|UNC2452|Operation Wocao|Rocke +T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,no +T1552.004,Private Keys,Credential Access,Rocke T1552.003,Bash History,Credential Access,no T1552.002,Credentials in Registry,Credential Access,APT32 -T1552.001,Credentials In Files,Credential Access,Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 +T1552.001,Credentials In Files,Credential Access,Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 T1552,Unsecured Credentials,Credential Access,no T1216.001,PubPrn,Defense Evasion,APT32 -T1070.006,Timestomp,Defense Evasion,APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 +T1070.006,Timestomp,Defense Evasion,Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390 -T1070.004,File Deletion,Defense Evasion,APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|Threat Group-3390|FIN10|APT28|Group5|Lazarus Group|APT18|APT29 +T1070.004,File Deletion,Defense Evasion,Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29 T1070.003,Clear Command History,Defense Evasion,APT41 -T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29|UNC2452 +T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28 T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29 -T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1 -T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29|UNC2452 +T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1 +T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no -T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 +T1548.002,Bypass User Access Control,Privilege Escalation|Defense Evasion,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no T1136.003,Cloud Account,Persistence,no T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke -T1070.001,Clear Windows Event Logs,Defense Evasion,Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 -T1136.002,Domain Account,Persistence,HAFNIUM|GALLIUM -T1136.001,Local Account,Persistence,Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3 +T1070.001,Clear Windows Event Logs,Defense Evasion,APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 +T1136.002,Domain Account,Persistence,Soft Cell +T1136.001,Local Account,Persistence,APT39|APT41|Dragonfly 2.0|Leafminer|APT3 T1547.011,Plist Modification,Persistence|Privilege Escalation,no T1547.010,Port Monitors,Persistence|Privilege Escalation,no -T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan +T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group T1547.008,LSASS Driver,Persistence|Privilege Escalation,no T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no -T1547.005,Security Support Provider,Persistence|Privilege Escalation,Lazarus Group -T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Wizard Spider|Tropic Trooper|Turla +T1547.005,Security Support Provider,Persistence|Privilege Escalation,no +T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla T1547.003,Time Providers,Persistence|Privilege Escalation,no T1546.014,Emond,Privilege Escalation|Persistence,no T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla @@ -359,38 +236,38 @@ T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistenc T1218.008,Odbcconf,Defense Evasion,Cobalt Group T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7 T1547.002,Authentication Package,Persistence|Privilege Escalation,no -T1546.010,AppInit DLLs,Privilege Escalation|Persistence,APT39 +T1546.010,AppInit DLLs,Privilege Escalation|Persistence,no T1546.009,AppCert DLLs,Privilege Escalation|Persistence,Honeybee -T1218.007,Msiexec,Defense Evasion,ZIRCONIUM|Molerats|Machete|TA505|Rancor -T1546.008,Accessibility Features,Privilege Escalation|Persistence,Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom +T1218.007,Msiexec,Defense Evasion,TA505|Rancor +T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|APT29|Deep Panda|Axiom T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no T1546.005,Trap,Privilege Escalation|Persistence,no -T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence,no -T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29 +T1546.004,.bash_profile and .bashrc,Privilege Escalation|Persistence,no +T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,APT33|Blue Mockingbird|Turla|Leviathan|APT29 T1546.002,Screensaver,Privilege Escalation|Persistence,no T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky -T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Honeybee|Dark Caracal|Threat Group-3390|Cobalt Group|Ke3chang|Gorgon Group|Dragonfly 2.0|APT37|MuddyWater|Leviathan|APT3|BRONZE BUTLER|Magic Hound|FIN7|FIN10|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel +T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel T1218.002,Control Panel,Defense Evasion,no -T1218.010,Regsvr32,Defense Evasion,TA551|Blue Mockingbird|Inception|WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda +T1218.010,Regsvr32,Defense Evasion,Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda T1218.009,Regsvcs/Regasm,Defense Evasion,no -T1218.005,Mshta,Defense Evasion,Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7 -T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass +T1218.005,Mshta,Defense Evasion,Inception|Kimsuky|APT32|MuddyWater|FIN7 +T1218.004,InstallUtil,Defense Evasion,no T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|Dark Caracal|OilRig T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater -T1218.011,Rundll32,Defense Evasion,HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 +T1218.011,Rundll32,Defense Evasion,APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no T1546,Event Triggered Execution,Privilege Escalation|Persistence,no T1098.003,Add Office 365 Global Administrator Role,Persistence,no -T1098.002,Exchange Email Delegate Permissions,Persistence,APT29|UNC2452|Magic Hound -T1098.001,Additional Cloud Credentials,Persistence,APT29|UNC2452 +T1098.002,Exchange Email Delegate Permissions,Persistence,Magic Hound +T1098.001,Additional Azure Service Principal Credentials,Persistence,no T1543.004,Launch Daemon,Persistence|Privilege Escalation,no -T1543.003,Windows Service,Persistence|Privilege Escalation,PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Honeybee|Threat Group-3390|APT3|Lazarus Group|Carbanak +T1543.003,Windows Service,Persistence|Privilege Escalation,Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke T1543.001,Launch Agent,Persistence|Privilege Escalation,no T1037.005,Startup Items,Persistence|Privilege Escalation,no -T1037.004,RC Scripts,Persistence|Privilege Escalation,no -T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|Gorgon Group|menuPass|Patchwork +T1037.004,Rc.common,Persistence|Privilege Escalation,no +T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no @@ -400,7 +277,7 @@ T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,no T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Rocke|Gorgon Group -T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda +T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda T1037.003,Network Logon Script,Persistence|Privilege Escalation,no T1543,Create or Modify System Process,Persistence|Privilege Escalation,no T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no @@ -408,13 +285,13 @@ T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|A T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28 T1542.002,Component Firmware,Persistence|Defense Evasion,Equation T1542.001,System Firmware,Persistence|Defense Evasion,no -T1505.003,Web Shell,Persistence,Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda +T1505.003,Web Shell,Persistence,Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda T1505.002,Transport Agent,Persistence,no T1505.001,SQL Stored Procedures,Persistence,no T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no -T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Rancor|Dragonfly 2.0|OilRig|Patchwork|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29 +T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29 T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18 T1542,Pre-OS Boot,Defense Evasion|Persistence,no T1137.001,Office Template Macros,Persistence,MuddyWater @@ -424,141 +301,140 @@ T1137.005,Outlook Rules,Persistence,no T1137.006,Add-ins,Persistence,Naikon T1137.002,Office Test,Persistence,APT28 T1531,Account Access Removal,Impact,no -T1539,Steal Web Session Cookie,Credential Access,Evilnum +T1539,Steal Web Session Cookie,Credential Access,no T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37 -T1518,Software Discovery,Discovery,Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception -T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no +T1518,Software Discovery,Discovery,BRONZE BUTLER|Tropic Trooper|Inception T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group T1528,Steal Application Access Token,Credential Access,APT28 T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no -T1525,Implant Internal Image,Persistence,no +T1525,Implant Container Image,Persistence,no T1538,Cloud Service Dashboard,Discovery,no -T1530,Data from Cloud Storage Object,Collection,Fox Kitten +T1530,Data from Cloud Storage Object,Collection,no T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no T1537,Transfer Data to Cloud Account,Exfiltration,no T1526,Cloud Service Discovery,Discovery,no T1505,Server Software Component,Persistence,no -T1499,Endpoint Denial of Service,Impact,Sandworm Team -T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,Darkhotel -T1498,Network Denial of Service,Impact,APT28 +T1499,Endpoint Denial of Service,Impact,no +T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,no +T1498,Network Denial of Service,Impact,no T1496,Resource Hijacking,Impact,Blue Mockingbird|Rocke|APT41|Lazarus Group T1495,Firmware Corruption,Impact,no T1491,Defacement,Impact,no T1490,Inhibit System Recovery,Impact,no -T1489,Service Stop,Impact,Wizard Spider|Lazarus Group -T1486,Data Encrypted for Impact,Impact,Indrik Spider|APT41|TA505|APT38 +T1489,Service Stop,Impact,Lazarus Group +T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38 T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38 -T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no -T1482,Domain Trust Discovery,Discovery,APT29|Chimera|UNC2452 +T1484,Group Policy Modification,Defense Evasion|Privilege Escalation,no +T1482,Domain Trust Discovery,Discovery,Wizard Spider T1480,Execution Guardrails,Defense Evasion,no T1222,File and Directory Permissions Modification,Defense Evasion,no -T1220,XSL Script Processing,Defense Evasion,Higaisa|Cobalt Group T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus -T1189,Drive-by Compromise,Initial Access,Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|Leafminer|Lazarus Group|BRONZE BUTLER|APT19|APT32|Threat Group-3390|Dark Caracal|Elderwood|APT37|Patchwork|PLATINUM -T1190,Exploit Public-Facing Application,Initial Access,Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom -T1210,Exploitation of Remote Services,Lateral Movement,Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 -T1217,Browser Bookmark Discovery,Discovery,Chimera|Fox Kitten -T1213,Data from Information Repositories,Collection,Fox Kitten|FIN6|Turla -T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan -T1219,Remote Access Software,Command And Control,Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak -T1195,Supply Chain Compromise,Initial Access,no -T1204,User Execution,Execution,no +T1220,XSL Script Processing,Defense Evasion,Cobalt Group +T1197,BITS Jobs,Defense Evasion|Persistence,Patchwork|APT41|Leviathan +T1217,Browser Bookmark Discovery,Discovery,no +T1213,Data from Information Repositories,Collection,Turla +T1189,Drive-by Compromise,Initial Access,Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM +T1203,Exploitation for Client Execution,Execution,Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29 T1212,Exploitation for Credential Access,Credential Access,no T1211,Exploitation for Defense Evasion,Defense Evasion,APT28 -T1200,Hardware Additions,Initial Access,DarkVishnya +T1190,Exploit Public-Facing Application,Initial Access,Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom +T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28 T1202,Indirect Command Execution,Defense Evasion,no -T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig +T1200,Hardware Additions,Initial Access,DarkVishnya +T1201,Password Policy Discovery,Discovery,Turla|OilRig +T1219,Remote Access Software,Command And Control,Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak T1207,Rogue Domain Controller,Defense Evasion,no -T1203,Exploitation for Client Execution,Execution,Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|Patchwork|APT29|TA459|Leviathan|Elderwood -T1216,Signed Script Proxy Execution,Defense Evasion,no -T1199,Trusted Relationship,Initial Access,Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass +T1199,Trusted Relationship,Initial Access,APT28|menuPass T1218,Signed Binary Proxy Execution,Defense Evasion,no +T1204,User Execution,Execution,no +T1216,Signed Script Proxy Execution,Defense Evasion,no +T1195,Supply Chain Compromise,Initial Access,Elderwood T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0 T1185,Man in the Browser,Collection,no -T1149,LC_MAIN Hijacking,Defense Evasion,no -T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird +T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird T1136,Create Account,Persistence,no +T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER +T1149,LC_MAIN Hijacking,Defense Evasion,no +T1135,Network Share Discovery,Discovery,APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug T1137,Office Application Startup,Persistence,Gamaredon Group|APT32 -T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|menuPass|Honeybee|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER -T1135,Network Share Discovery,Discovery,Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug T1153,Source,Execution,no -T1133,External Remote Services,Persistence|Initial Access,APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 +T1133,External Remote Services,Persistence|Initial Access,Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 T1132,Data Encoding,Command And Control,no T1129,Shared Modules,Execution,no T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no T1125,Video Capture,Collection,Silence|FIN7 -T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla +T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla T1123,Audio Capture,Collection,APT37 -T1120,Peripheral Device Discovery,Discovery,Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28 -T1119,Automated Collection,Collection,Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 -T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38 -T1114,Email Collection,Collection,Silent Librarian -T1113,Screen Capture,Collection,GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 -T1112,Modify Registry,Defense Evasion,Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Patchwork|Gorgon Group|Honeybee|FIN8 -T1111,Two-Factor Authentication Interception,Credential Access,Chimera|Operation Wocao -T1110,Brute Force,Credential Access,APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla +T1120,Peripheral Device Discovery,Discovery,Turla|APT37|Gamaredon Group|Equation|APT28 +T1119,Automated Collection,Collection,Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 +T1115,Clipboard Data,Collection,APT39|APT38 +T1114,Email Collection,Collection,no +T1113,Screen Capture,Collection,Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 +T1112,Modify Registry,Defense Evasion,Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8 +T1111,Two-Factor Authentication Interception,Credential Access,no +T1110,Brute Force,Credential Access,DarkVishnya|APT39|OilRig|FIN5|Turla T1108,Redundant Access,Defense Evasion|Persistence,no -T1106,Native API,Execution,Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group -T1105,Ingress Tool Transfer,Command And Control,HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Gorgon Group|Turla|OilRig|Dragonfly 2.0|APT37|Leviathan|FIN8|PLATINUM|Elderwood|APT3|Magic Hound|APT32|BRONZE BUTLER|FIN7|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 +T1106,Native API,Execution,Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37 +T1105,Ingress Tool Transfer,Command And Control,Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3 -T1102,Web Service,Command And Control,Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 +T1102,Web Service,Command And Control,Gamaredon Group|Rocke|Inception|FIN6 T1098,Account Manipulation,Persistence,APT3|Dragonfly 2.0|Lazarus Group -T1095,Non-Application Layer Protocol,Command And Control,HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3 +T1095,Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3 T1092,Communication Through Removable Media,Command And Control,APT28 -T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Mustang Panda|Tropic Trooper|Darkhotel|APT28 -T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla -T1087,Account Discovery,Discovery,APT29|UNC2452 -T1083,File and Directory Discovery,Discovery,APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Dragonfly 2.0|Leafminer|Honeybee|Dark Caracal|Magic Hound|APT3|BRONZE BUTLER|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang -T1082,System Information Discovery,Discovery,APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT37|APT19|Honeybee|APT32|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang -T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel -T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|OilRig|FIN5|menuPass|FIN10|APT28|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak +T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Tropic Trooper|Darkhotel|APT28 +T1090,Proxy,Command And Control,Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla +T1087,Account Discovery,Discovery,no +T1083,File and Directory Discovery,Discovery,Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang +T1082,System Information Discovery,Discovery,Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang +T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Darkhotel +T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak T1074,Data Staged,Collection,Wizard Spider T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314 T1071,Application Layer Protocol,Command And Control,Rocke|Magic Hound|Dragonfly 2.0 -T1070,Indicator Removal on Host,Defense Evasion,APT29|UNC2452 -T1069,Permission Groups Discovery,Discovery,APT29|UNC2452|TA505|APT3 -T1068,Exploitation for Privilege Escalation,Privilege Escalation,ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 +T1070,Indicator Removal on Host,Defense Evasion,no +T1069,Permission Groups Discovery,Discovery,TA505|APT3 +T1068,Exploitation for Privilege Escalation,Privilege Escalation,Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 T1064,Scripting,Defense Evasion|Execution,no T1062,Hypervisor,Persistence,no T1061,Graphical User Interface,Execution,no -T1059,Command and Scripting Interpreter,Execution,Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang -T1057,Process Discovery,Discovery,APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang -T1056,Input Capture,Collection|Credential Access,APT39 -T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM +T1059,Command and Scripting Interpreter,Execution,APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang +T1057,Process Discovery,Discovery,Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang +T1056,Input Capture,Collection|Credential Access,no +T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no T1052,Exfiltration Over Physical Medium,Exfiltration,no T1051,Shared Webroot,Lateral Movement,no -T1049,System Network Connections Discovery,Discovery,Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang +T1049,System Network Connections Discovery,Discovery,Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang T1048,Exfiltration Over Alternative Protocol,Exfiltration,no -T1047,Windows Management Instrumentation,Execution,Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda -T1046,Network Service Scanning,Discovery,Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Leafminer|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 -T1043,Commonly Used Port,Command And Control,OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 -T1041,Exfiltration Over C2 Channel,Exfiltration,ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang -T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 -T1039,Data from Network Shared Drive,Collection,Chimera|Fox Kitten|Gamaredon Group|Sowbug|BRONZE BUTLER|menuPass +T1047,Windows Management Instrumentation,Execution,Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda +T1046,Network Service Scanning,Discovery,Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 +T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 +T1041,Exfiltration Over C2 Channel,Exfiltration,Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang +T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 +T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke -T1036,Masquerading,Defense Evasion,APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 +T1036,Masquerading,Defense Evasion,Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0 T1034,Path Interception,Persistence|Privilege Escalation,no -T1033,System Owner/User Discovery,Discovery,Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 +T1033,System Owner/User Discovery,Discovery,Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390 -T1029,Scheduled Transfer,Exfiltration,Higaisa -T1027,Obfuscated Files or Information,Defense Evasion,APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|APT37|Honeybee|menuPass|Leafminer|Cobalt Group|Threat Group-3390|Dark Caracal|APT19|FIN8|BlackOasis|MuddyWater|Elderwood|Leviathan|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 +T1029,Scheduled Transfer,Exfiltration,no +T1027,Obfuscated Files or Information,Defense Evasion,Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 T1026,Multiband Communication,Command And Control,Lazarus Group -T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28 +T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28 T1021,Remote Services,Lateral Movement,no -T1020,Automated Exfiltration,Exfiltration,Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee -T1018,Remote System Discovery,Discovery,APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Dragonfly 2.0|Deep Panda|Threat Group-3390|Leafminer|Ke3chang|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla -T1016,System Network Configuration Discovery,Discovery,ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang +T1020,Automated Exfiltration,Exfiltration,Tropic Trooper|Frankenstein|Honeybee +T1018,Remote System Discovery,Discovery,Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla +T1016,System Network Configuration Discovery,Discovery,Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang T1014,Rootkit,Defense Evasion,Rocke|APT41|APT28|Winnti Group -T1012,Query Registry,Discovery,ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla +T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla T1011,Exfiltration Over Other Network Medium,Exfiltration,no T1010,Application Window Discovery,Discovery,Lazarus Group -T1008,Fallback Channels,Command And Control,Carbanak|APT41|OilRig|Lazarus Group -T1007,System Service Discovery,Discovery,Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang +T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group +T1007,System Service Discovery,Discovery,BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang T1006,Direct Volume Access,Defense Evasion,no -T1005,Data from Local System,Collection,APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang +T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom -T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom +T1001,Data Obfuscation,Command And Control,Axiom diff --git a/dist/saaws/app.manifest b/dist/saaws/app.manifest index 66717fdb3c..d6a58281b7 100644 --- a/dist/saaws/app.manifest +++ b/dist/saaws/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS_AmazonWebServices_Content", - "version": "3.24.0" + "version": "3.25.0" }, "author": [ { diff --git a/dist/saaws/default/analytic_stories.conf b/dist/saaws/default/analytic_stories.conf index 79856b4d51..7a3c67a23b 100644 --- a/dist/saaws/default/analytic_stories.conf +++ b/dist/saaws/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:54 UTC +# On Date: 2021-07-02T15:45:19 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/analyticstories.conf b/dist/saaws/default/analyticstories.conf index b25af82b9d..1adf735d80 100644 --- a/dist/saaws/default/analyticstories.conf +++ b/dist/saaws/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:54 UTC +# On Date: 2021-07-02T15:45:19 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -167,8 +167,8 @@ In addition to compromising the security of your data, when bad actors leverage type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user created a policy version that allows them to access any resource in their account -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources providing_technologies = [] @@ -177,8 +177,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. providing_technologies = [] @@ -187,8 +187,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user. providing_technologies = [] @@ -208,7 +208,7 @@ type = detection asset_type = AWS Account confidence = medium explanation = This search provides detection of KMS keys which action kms:Encrypt is accessible for everyone (also outside of your organization). This is an identicator that your account is compromised and the attacker uses the encryption key to compromise another company. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"mitre_attack": ["T1486"]} known_false_positives = unknown providing_technologies = [] @@ -218,7 +218,7 @@ type = detection asset_type = S3 Bucket confidence = medium explanation = This search provides detection of users with KMS keys performing encryption specifically against S3 buckets. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"mitre_attack": ["T1486"]} known_false_positives = bucket with S3 encryption providing_technologies = [] @@ -227,8 +227,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives. providing_technologies = [] @@ -287,8 +287,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail inputs. +explanation = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs. annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment. providing_technologies = [] @@ -297,8 +297,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that a user has legitimately deleted a network ACL. providing_technologies = [] @@ -308,7 +308,7 @@ type = detection asset_type = AWS Federated Account confidence = medium explanation = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"mitre_attack": ["T1078"]} known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. providing_technologies = [] @@ -318,7 +318,7 @@ type = detection asset_type = AWS Federated Account confidence = medium explanation = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"mitre_attack": ["T1078"]} known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. providing_technologies = [] @@ -327,8 +327,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources providing_technologies = [] @@ -337,8 +337,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. providing_technologies = [] @@ -491,8 +491,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -501,8 +501,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -511,8 +511,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -521,8 +521,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -531,7 +531,7 @@ providing_technologies = [] type = detection asset_type = S3 Bucket confidence = medium -explanation = This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. how_to_implement = annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. @@ -541,7 +541,7 @@ providing_technologies = [] type = detection asset_type = S3 Bucket confidence = medium -explanation = This search looks for CloudTrail events where a user has created an open/public S3 bucket. +explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. how_to_implement = You must install the AWS App for Splunk. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. diff --git a/dist/saaws/default/app.conf b/dist/saaws/default/app.conf index 7f5a2a9139..44ea777aa9 100644 --- a/dist/saaws/default/app.conf +++ b/dist/saaws/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 32018 +build = 32560 [triggers] reload.analytic_stories = simple @@ -18,7 +18,7 @@ reload.content-version = simple [launcher] author = Splunk -version = 3.24.0 +version = 3.25.0 description = Explore the Analytic Stories included with Splunk Security Analytics for AWS Content [ui] diff --git a/dist/saaws/default/collections.conf b/dist/saaws/default/collections.conf index 03d7f85f2e..22931e8b22 100644 --- a/dist/saaws/default/collections.conf +++ b/dist/saaws/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:54 UTC +# On Date: 2021-07-02T15:45:19 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/content-version.conf b/dist/saaws/default/content-version.conf index e01cb50393..a2f4506a6a 100644 --- a/dist/saaws/default/content-version.conf +++ b/dist/saaws/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.24.0 +version = 3.25.0 diff --git a/dist/saaws/default/macros.conf b/dist/saaws/default/macros.conf index da30ca8629..ed45078fb9 100644 --- a/dist/saaws/default/macros.conf +++ b/dist/saaws/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:54 UTC +# On Date: 2021-07-02T15:45:19 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -206,6 +206,10 @@ description = Use this macro to determine how far back you should be checking fo definition = "-70m@m" description = Use this macro to determine how far back you should be checking for new provisioning activities +[printservice] +definition = source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin" +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [prohibited_apps_launching_cmd] definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name description = This macro outputs a list of process that should not be the parent process of cmd.exe diff --git a/dist/saaws/default/savedsearches.conf b/dist/saaws/default/savedsearches.conf index 039371aa3a..da21ac2a2f 100644 --- a/dist/saaws/default/savedsearches.conf +++ b/dist/saaws/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:54 UTC +# On Date: 2021-07-02T15:45:19 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -10,11 +10,11 @@ [ESCU - AWS Create Policy Version to allow all resources - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user created a policy version that allows them to access any resource in their account +description = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user created a policy version that allows them to access any resource in their account -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources action.escu.creation_date = 2021-02-22 action.escu.modification_date = 2021-02-22 @@ -25,9 +25,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -50,11 +52,11 @@ search = `cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws. [ESCU - AWS CreateAccessKey - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +description = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. action.escu.creation_date = 2021-03-02 action.escu.modification_date = 2021-03-02 @@ -65,9 +67,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -90,11 +94,11 @@ search = `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws. [ESCU - AWS CreateLoginProfile - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip +description = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user. action.escu.creation_date = 2021-03-02 action.escu.modification_date = 2021-03-02 @@ -105,9 +109,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src_ip -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -145,9 +151,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 15 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -174,7 +182,7 @@ description = This search provides detection of KMS keys which action kms:Encryp action.escu.mappings = {"mitre_attack": ["T1486"]} action.escu.data_models = [] action.escu.eli5 = This search provides detection of KMS keys which action kms:Encrypt is accessible for everyone (also outside of your organization). This is an identicator that your account is compromised and the attacker uses the encryption key to compromise another company. -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs action.escu.known_false_positives = unknown action.escu.creation_date = 2021-01-11 action.escu.modification_date = 2021-01-11 @@ -185,9 +193,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware Cloud"] action.risk = 1 -action.risk.param._risk_object = userIdentity.principalId -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -214,7 +224,7 @@ description = This search provides detection of users with KMS keys performing e action.escu.mappings = {"mitre_attack": ["T1486"]} action.escu.data_models = [] action.escu.eli5 = This search provides detection of users with KMS keys performing encryption specifically against S3 buckets. -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs action.escu.known_false_positives = bucket with S3 encryption action.escu.creation_date = 2021-01-11 action.escu.modification_date = 2021-01-11 @@ -225,9 +235,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware Cloud"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 25 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -250,11 +262,11 @@ search = `cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-e [ESCU - AWS Excessive Security Scanning - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. +description = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.eli5 = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives. action.escu.creation_date = 2021-04-13 action.escu.modification_date = 2021-04-13 @@ -265,9 +277,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -305,9 +319,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = src_ip -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -345,9 +361,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -385,9 +403,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -425,9 +445,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -465,9 +487,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -490,11 +514,11 @@ search = `cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorC [ESCU - AWS Network Access Control List Created with All Open Ports - Rule] action.escu = 0 action.escu.enabled = 1 -description = The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. +description = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] -action.escu.eli5 = The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail inputs. +action.escu.eli5 = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs. action.escu.known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment. action.escu.creation_date = 2021-01-11 action.escu.modification_date = 2021-01-11 @@ -505,9 +529,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity"] action.risk = 1 -action.risk.param._risk_object = userName -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -530,11 +556,11 @@ search = `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor [ESCU - AWS Network Access Control List Deleted - Rule] action.escu = 0 action.escu.enabled = 1 -description = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs. +description = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] -action.escu.eli5 = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +action.escu.eli5 = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. action.escu.known_false_positives = It's possible that a user has legitimately deleted a network ACL. action.escu.creation_date = 2021-01-12 action.escu.modification_date = 2021-01-12 @@ -545,9 +571,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity"] action.risk = 1 -action.risk.param._risk_object = userName -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -574,7 +602,7 @@ description = This search provides specific SAML access from specific Service Pr action.escu.mappings = {"mitre_attack": ["T1078"]} action.escu.data_models = [] action.escu.eli5 = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs action.escu.known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. action.escu.creation_date = 2021-01-26 action.escu.modification_date = 2021-01-26 @@ -585,9 +613,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = recipientAccountId -action.risk.param._risk_object_type = other +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 25 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -614,7 +644,7 @@ description = This search provides detection of updates to SAML provider in AWS. action.escu.mappings = {"mitre_attack": ["T1078"]} action.escu.data_models = [] action.escu.eli5 = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. action.escu.creation_date = 2021-01-26 action.escu.modification_date = 2021-01-26 @@ -625,9 +655,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = sourceIPAddress -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -650,11 +682,11 @@ search = `cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as f [ESCU - AWS SetDefaultPolicyVersion - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy +description = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources action.escu.creation_date = 2021-03-02 action.escu.modification_date = 2021-03-02 @@ -665,9 +697,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -690,11 +724,11 @@ search = `cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazon [ESCU - AWS UpdateLoginProfile - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +description = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. action.escu.creation_date = 2021-03-02 action.escu.modification_date = 2021-03-02 @@ -705,9 +739,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -747,14 +783,16 @@ action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user -action.risk.param._risk_score = 25 +action.risk.param._risk_score = 15 +action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = false @@ -785,9 +823,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -825,9 +865,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 40 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -865,9 +907,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 25 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -905,9 +949,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 25 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -945,9 +991,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -985,9 +1033,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1025,9 +1075,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1065,9 +1117,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1105,9 +1159,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1146,9 +1202,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1187,9 +1245,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1228,9 +1288,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1269,9 +1331,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1294,11 +1358,11 @@ search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from d [ESCU - Detect AWS Console Login by New User - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = ["Authentication"] -action.escu.eli5 = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. +action.escu.eli5 = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. action.escu.creation_date = 2020-05-28 action.escu.modification_date = 2020-05-28 @@ -1309,9 +1373,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 30 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1334,11 +1400,11 @@ search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from da [ESCU - Detect AWS Console Login by User from New City - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = ["Authentication"] -action.escu.eli5 = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. +action.escu.eli5 = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. action.escu.creation_date = 2020-10-07 action.escu.modification_date = 2020-10-07 @@ -1349,9 +1415,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1374,11 +1442,11 @@ search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from da [ESCU - Detect AWS Console Login by User from New Country - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = ["Authentication"] -action.escu.eli5 = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. +action.escu.eli5 = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. action.escu.creation_date = 2020-10-07 action.escu.modification_date = 2020-10-07 @@ -1389,9 +1457,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1414,11 +1484,11 @@ search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from da [ESCU - Detect AWS Console Login by User from New Region - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = ["Authentication"] -action.escu.eli5 = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. +action.escu.eli5 = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. action.escu.creation_date = 2020-10-07 action.escu.modification_date = 2020-10-07 @@ -1429,9 +1499,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1454,10 +1526,10 @@ search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from da [ESCU - Detect New Open S3 Buckets over AWS CLI - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. action.escu.how_to_implement = action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. action.escu.creation_date = 2021-01-12 @@ -1469,9 +1541,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1494,10 +1568,10 @@ search = `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR r [ESCU - Detect New Open S3 buckets - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user has created an open/public S3 bucket. +description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user has created an open/public S3 bucket. +action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. action.escu.how_to_implement = You must install the AWS App for Splunk. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. action.escu.creation_date = 2021-01-12 @@ -1509,9 +1583,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1549,9 +1625,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Security Hub Alerts"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1589,9 +1667,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1629,9 +1709,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = ActorIpAddress -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1669,9 +1751,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1709,9 +1793,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1749,9 +1835,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1789,9 +1877,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1829,9 +1919,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = UserId -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1869,9 +1961,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = Source -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1909,9 +2003,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = src_user -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1949,9 +2045,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1989,9 +2087,11 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = ForwardingSmtpAddress -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m diff --git a/dist/saaws/default/transforms.conf b/dist/saaws/default/transforms.conf index faa63c922c..80a8650880 100644 --- a/dist/saaws/default/transforms.conf +++ b/dist/saaws/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:54 UTC +# On Date: 2021-07-02T15:45:19 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/use_case_library.conf b/dist/saaws/default/use_case_library.conf index b25af82b9d..1adf735d80 100644 --- a/dist/saaws/default/use_case_library.conf +++ b/dist/saaws/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-24T18:00:54 UTC +# On Date: 2021-07-02T15:45:19 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -167,8 +167,8 @@ In addition to compromising the security of your data, when bad actors leverage type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user created a policy version that allows them to access any resource in their account -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources providing_technologies = [] @@ -177,8 +177,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. providing_technologies = [] @@ -187,8 +187,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user. providing_technologies = [] @@ -208,7 +208,7 @@ type = detection asset_type = AWS Account confidence = medium explanation = This search provides detection of KMS keys which action kms:Encrypt is accessible for everyone (also outside of your organization). This is an identicator that your account is compromised and the attacker uses the encryption key to compromise another company. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"mitre_attack": ["T1486"]} known_false_positives = unknown providing_technologies = [] @@ -218,7 +218,7 @@ type = detection asset_type = S3 Bucket confidence = medium explanation = This search provides detection of users with KMS keys performing encryption specifically against S3 buckets. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"mitre_attack": ["T1486"]} known_false_positives = bucket with S3 encryption providing_technologies = [] @@ -227,8 +227,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives. providing_technologies = [] @@ -287,8 +287,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail inputs. +explanation = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs. annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment. providing_technologies = [] @@ -297,8 +297,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that a user has legitimately deleted a network ACL. providing_technologies = [] @@ -308,7 +308,7 @@ type = detection asset_type = AWS Federated Account confidence = medium explanation = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs annotations = {"mitre_attack": ["T1078"]} known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. providing_technologies = [] @@ -318,7 +318,7 @@ type = detection asset_type = AWS Federated Account confidence = medium explanation = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"mitre_attack": ["T1078"]} known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. providing_technologies = [] @@ -327,8 +327,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources providing_technologies = [] @@ -337,8 +337,8 @@ providing_technologies = [] type = detection asset_type = AWS Account confidence = medium -explanation = This search looks for CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +explanation = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. providing_technologies = [] @@ -491,8 +491,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -501,8 +501,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -511,8 +511,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -521,8 +521,8 @@ providing_technologies = [] type = detection asset_type = AWS Instance confidence = medium -explanation = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. +explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -531,7 +531,7 @@ providing_technologies = [] type = detection asset_type = S3 Bucket confidence = medium -explanation = This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. how_to_implement = annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. @@ -541,7 +541,7 @@ providing_technologies = [] type = detection asset_type = S3 Bucket confidence = medium -explanation = This search looks for CloudTrail events where a user has created an open/public S3 bucket. +explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. how_to_implement = You must install the AWS App for Splunk. annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. diff --git a/docs/detections.md b/docs/detections.md index 8c3ab519c0..9260604672 100644 --- a/docs/detections.md +++ b/docs/detections.md @@ -264,6 +264,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -546,6 +548,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -565,6 +569,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [High Number of Login Failures from a single source](#high-number-of-login-failures-from-a-single-source) @@ -652,6 +658,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -1018,6 +1026,24 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + @@ -1368,6 +1394,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Deny Permission using Cacls Utility](#deny-permission-using-cacls-utility) + + + @@ -1778,6 +1808,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Excessive number of service control start as disabled](#excessive-number-of-service-control-start-as-disabled) + + + - [Excessive number of taskhost processes](#excessive-number-of-taskhost-processes) @@ -1822,6 +1856,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Grant Permission Using Cacls Utility](#grant-permission-using-cacls-utility) + + + - [Hide User Account From Sign-In Screen](#hide-user-account-from-sign-in-screen) @@ -1938,6 +1976,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Modify ACLs Permission Of Files Or Folders](#modify-acls-permission-of-files-or-folders) + + + - [Monitor Registry Keys for Print Monitors](#monitor-registry-keys-for-print-monitors) @@ -2118,6 +2160,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Print Spooler Adding A Printer Driver](#print-spooler-adding-a-printer-driver) + + + +- [Print Spooler Failed to Load a Plug-in](#print-spooler-failed-to-load-a-plug-in) + + + - [Probing Access with Stolen Credentials via PowerSploit modules](#probing-access-with-stolen-credentials-via-powersploit-modules) @@ -2386,6 +2436,26 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Spoolsv Spawning Rundll32](#spoolsv-spawning-rundll32) + + + +- [Spoolsv Suspicious Loaded Modules](#spoolsv-suspicious-loaded-modules) + + + +- [Spoolsv Suspicious Process Access](#spoolsv-suspicious-process-access) + + + +- [Spoolsv Writing a DLL](#spoolsv-writing-a-dll) + + + +- [Spoolsv Writing a DLL - Sysmon](#spoolsv-writing-a-dll---sysmon) + + + - [Start Up During Safe Mode Boot](#start-up-during-safe-mode-boot) @@ -2594,6 +2664,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [WevtUtil Usage To Clear Logs](#wevtutil-usage-to-clear-logs) + + + +- [Wevtutil Usage To Disable Logs](#wevtutil-usage-to-disable-logs) + + + - [WinEvent Scheduled Task Created Within Public Path](#winevent-scheduled-task-created-within-public-path) @@ -2851,6 +2929,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [Detect ARP Poisoning](#detect-arp-poisoning) @@ -3150,6 +3230,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -3216,6 +3300,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -3336,6 +3422,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -3540,6 +3630,16 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + @@ -3625,6 +3725,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -3885,6 +3989,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -4153,6 +4259,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + @@ -4425,6 +4537,20 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + @@ -4572,6 +4698,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -4806,6 +4936,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -5102,6 +5234,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + @@ -5312,6 +5450,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -5356,6 +5498,16 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + @@ -5503,6 +5655,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -5514,7 +5670,7 @@ All the detections shipped to different Splunk products. Below is a breakdown by ### AWS Create Policy Version to allow all resources -This search looks for CloudTrail events where a user created a policy version that allows them to access any resource in their account +This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: @@ -5542,7 +5698,7 @@ This search looks for CloudTrail events where a user created a policy version th #### How To Implement -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. #### Required field @@ -5562,7 +5718,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -5593,7 +5749,7 @@ _version_: 2 --- ### AWS CreateAccessKey -This search looks for CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: @@ -5618,7 +5774,7 @@ This search looks for CloudTrail events where a user A who has already permissio #### How To Implement -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. #### Required field @@ -5669,7 +5825,7 @@ _version_: 1 --- ### AWS CreateLoginProfile -This search looks for CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip +This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: @@ -5698,7 +5854,7 @@ This search looks for CloudTrail events where a user A(victim A) creates a login #### How To Implement -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. #### Required field @@ -5852,7 +6008,7 @@ This search provides detection of KMS keys which action kms:Encrypt is accessibl #### How To Implement -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs #### Required field @@ -5932,7 +6088,7 @@ This search provides detection of users with KMS keys performing encryption spec #### How To Implement -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs #### Required field @@ -5989,7 +6145,7 @@ _version_: 1 --- ### AWS Excessive Security Scanning -This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. +This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: @@ -6014,7 +6170,7 @@ This search looks for CloudTrail events and analyse the amount of eventNames whi #### How To Implement -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. #### Required field @@ -6447,7 +6603,7 @@ _version_: 1 --- ### AWS Network Access Control List Created with All Open Ports -The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. +The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: @@ -6475,7 +6631,7 @@ The search looks for CloudTrail events to detect if any network ACLs were create #### How To Implement -You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail inputs. +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs. #### Required field @@ -6532,7 +6688,7 @@ _version_: 2 --- ### AWS Network Access Control List Deleted -Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs. +Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: @@ -6557,7 +6713,7 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo #### How To Implement -You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. #### Required field @@ -6630,7 +6786,7 @@ This search provides specific SAML access from specific Service Provider, user a #### How To Implement -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs #### Required field @@ -6658,7 +6814,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -6715,7 +6871,7 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA #### How To Implement -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. #### Required field @@ -6741,7 +6897,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -6774,7 +6930,7 @@ _version_: 1 --- ### AWS SetDefaultPolicyVersion -This search looks for CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy +This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: @@ -6798,7 +6954,7 @@ This search looks for CloudTrail events where a user has set a default policy ve #### How To Implement -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. #### Required field @@ -6820,7 +6976,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -6851,7 +7007,7 @@ _version_: 1 --- ### AWS UpdateLoginProfile -This search looks for CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: @@ -6876,7 +7032,7 @@ This search looks for CloudTrail events where a user A who has already permissio #### How To Implement -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. #### Required field @@ -6981,7 +7137,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -7063,7 +7219,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -7145,7 +7301,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -7224,7 +7380,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -7615,7 +7771,7 @@ To successfully implement this search, you must be ingesting data that records r | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -8120,12 +8276,12 @@ You must be ingesting Windows Security logs from devices of interest, including | ----------- | ----------- |--------------| | T1055 | Process Injection | Defense Evasion, Privilege Escalation | | T1068 | Exploitation for Privilege Escalation | Privilege Escalation | -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1098 | Account Manipulation | Persistence | | T1134 | Access Token Manipulation | Defense Evasion, Privilege Escalation | | T1543 | Create or Modify System Process | Persistence, Privilege Escalation | | T1547 | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | -| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | | T1554 | Compromise Client Software Binary | Persistence | | T1556 | Modify Authentication Process | Credential Access, Defense Evasion, Persistence | | T1558 | Steal or Forge Kerberos Tickets | Credential Access | @@ -8206,12 +8362,12 @@ You must be ingesting Windows Security logs from devices of interest, including | ----------- | ----------- |--------------| | T1055 | Process Injection | Defense Evasion, Privilege Escalation | | T1068 | Exploitation for Privilege Escalation | Privilege Escalation | -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1098 | Account Manipulation | Persistence | | T1134 | Access Token Manipulation | Defense Evasion, Privilege Escalation | | T1543 | Create or Modify System Process | Persistence, Privilege Escalation | | T1547 | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | -| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | | T1554 | Compromise Client Software Binary | Persistence | | T1555 | Credentials from Password Stores | Credential Access | | T1558 | Steal or Forge Kerberos Tickets | Credential Access | @@ -8288,7 +8444,7 @@ You must be ingesting Windows Security logs from devices of interest, including | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1098 | Account Manipulation | Persistence | | T1087 | Account Discovery | Discovery | | T1201 | Password Policy Discovery | Discovery | @@ -8824,7 +8980,7 @@ To successfully implement this search you need to be ingesting information on pr | ID | Technique | Tactic | | ----------- | ----------- |--------------| | T1197 | BITS Jobs | Defense Evasion, Persistence | -| T1105 | Ingress Tool Transfer | Command and Control | +| T1105 | Ingress Tool Transfer | Command And Control | #### Kill Chain Phase @@ -9146,7 +9302,7 @@ To successfully implement this search you need to be ingesting information on pr | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1105 | Ingress Tool Transfer | Command and Control | +| T1105 | Ingress Tool Transfer | Command And Control | #### Kill Chain Phase @@ -9228,7 +9384,7 @@ To successfully implement this search you need to be ingesting information on pr | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1105 | Ingress Tool Transfer | Command and Control | +| T1105 | Ingress Tool Transfer | Command And Control | #### Kill Chain Phase @@ -9779,7 +9935,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -9852,7 +10008,7 @@ You must be ingesting the appropriate cloud-infrastructure logs Run the "Previou | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -10142,7 +10298,7 @@ This search has a dependency on other searches to create and update a baseline o | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -10221,7 +10377,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -10301,7 +10457,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -10379,7 +10535,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -10459,7 +10615,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -12522,7 +12678,7 @@ Detailed documentation on how to create a new field within Incident Review may b | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1071.004 | DNS | Command and Control | +| T1071.004 | DNS | Command And Control | #### Kill Chain Phase @@ -12937,6 +13093,84 @@ _version_: 4 --- +### Deny Permission using Cacls Utility +This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection and prevent access to their component files. + +- **Product**: Splunk Behavioral Analytics +- **Datamodel**: Endpoint +- **ATT&CK**: [T1222](https://attack.mitre.org/techniques/T1222/) +- **Last Updated**: 2021-06-14 + +
+ details + +#### Search +``` + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); +``` +#### Associated Analytic Story + +* XMRig + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. + +#### Required field + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1222 | File and Directory Permissions Modification | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network administrator may use this windows utility but this is not a common practice. + +#### Reference + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + + +_version_: 1 +
+ +--- + ### Detect ARP Poisoning By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure. @@ -12991,7 +13225,7 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne | ----------- | ----------- |--------------| | T1200 | Hardware Additions | Initial Access | | T1498 | Network Denial of Service | Impact | -| T1557.002 | ARP Cache Poisoning | Collection, Credential Access | +| T1557.002 | ARP Cache Poisoning | Credential Access, Collection | #### Kill Chain Phase @@ -13018,7 +13252,7 @@ _version_: 1 --- ### Detect AWS Console Login by New User -This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Authentication @@ -13047,7 +13281,7 @@ This search looks for CloudTrail events wherein a console login event by a user #### How To Implement -You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. #### Required field @@ -13082,7 +13316,7 @@ _version_: 1 --- ### Detect AWS Console Login by User from New City -This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Authentication @@ -13119,7 +13353,7 @@ This search looks for CloudTrail events wherein a console login event by a user #### How To Implement -You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. #### Required field @@ -13162,7 +13396,7 @@ _version_: 1 --- ### Detect AWS Console Login by User from New Country -This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Authentication @@ -13199,7 +13433,7 @@ This search looks for CloudTrail events wherein a console login event by a user #### How To Implement -You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. #### Required field @@ -13242,7 +13476,7 @@ _version_: 1 --- ### Detect AWS Console Login by User from New Region -This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Authentication @@ -13279,7 +13513,7 @@ This search looks for CloudTrail events wherein a console login event by a user #### How To Implement -You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. #### Required field @@ -14116,7 +14350,7 @@ If Splunk>Phantom is also configured in your environment, a Playbook called "Exc | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.002 | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.002 | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -14186,7 +14420,7 @@ ou must ingest your Windows security event logs in the `Change` datamodel under | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.003 | Local Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.003 | Local Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -14855,7 +15089,7 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne | ----------- | ----------- |--------------| | T1200 | Hardware Additions | Initial Access | | T1498 | Network Denial of Service | Impact | -| T1557.002 | ARP Cache Poisoning | Collection, Credential Access | +| T1557.002 | ARP Cache Poisoning | Credential Access, Collection | #### Kill Chain Phase @@ -15029,7 +15263,7 @@ In order to run this search effectively, we highly recommend that you leverage t | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1095 | Non-Application Layer Protocol | Command and Control | +| T1095 | Non-Application Layer Protocol | Command And Control | #### Kill Chain Phase @@ -15522,7 +15756,7 @@ _version_: 1 --- ### Detect New Open S3 Buckets over AWS CLI -This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: @@ -15607,7 +15841,7 @@ _version_: 1 --- ### Detect New Open S3 buckets -This search looks for CloudTrail events where a user has created an open/public S3 bucket. +This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: @@ -15748,7 +15982,7 @@ In order to run this search effectively, we highly recommend that you leverage t | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1071.002 | File Transfer Protocols | Command and Control | +| T1071.002 | File Transfer Protocols | Command And Control | #### Kill Chain Phase @@ -15992,7 +16226,7 @@ You must be ingesting data that records process activity from your hosts to popu | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1574.009 | Path Interception by Unquoted Path | Defense Evasion, Persistence, Privilege Escalation | +| T1574.009 | Path Interception by Unquoted Path | Persistence, Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -16080,7 +16314,7 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne | ----------- | ----------- |--------------| | T1200 | Hardware Additions | Initial Access | | T1498 | Network Denial of Service | Impact | -| T1557.002 | ARP Cache Poisoning | Collection, Credential Access | +| T1557.002 | ARP Cache Poisoning | Credential Access, Collection | #### Kill Chain Phase @@ -17514,7 +17748,7 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne | ----------- | ----------- |--------------| | T1200 | Hardware Additions | Initial Access | | T1498 | Network Denial of Service | Impact | -| T1557 | Man-in-the-Middle | Collection, Credential Access | +| T1557 | Man-in-the-Middle | Credential Access, Collection | #### Kill Chain Phase @@ -18554,7 +18788,7 @@ This search detects users creating spikes in API activity related to deletion of #### How To Implement -You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity. +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity. #### Required field @@ -18930,7 +19164,7 @@ To successfully implement this search, you need to be ingesting logs with that p | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1546.003 | Windows Management Instrumentation Event Subscription | Persistence, Privilege Escalation | +| T1546.003 | Windows Management Instrumentation Event Subscription | Privilege Escalation, Persistence | #### Kill Chain Phase @@ -20730,7 +20964,7 @@ To successfully implement this search, you must be ingesting data that records r | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation | +| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -20965,7 +21199,7 @@ To successfully implement this search, you need to be ingesting logs with the pr | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1105 | Ingress Tool Transfer | Command and Control | +| T1105 | Ingress Tool Transfer | Command And Control | #### Kill Chain Phase @@ -21659,7 +21893,7 @@ To successfully implement this search you need to be ingesting information on pr | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation | +| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -21985,7 +22219,7 @@ To successfully implement this search you must ensure that DNS data is populatin | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1071.004 | DNS | Command and Control | +| T1071.004 | DNS | Command And Control | #### Kill Chain Phase @@ -22483,6 +22717,89 @@ Many benign applications will create processes from executables in Windows\Temp, * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/windows_temp_processes/logExcessiveWindowsTemp.log +_version_: 1 + + +--- + +### Excessive number of service control start as disabled +This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562/001/) +- **Last Updated**: 2021-06-25 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` distinct_count(Processes.process) as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_id, _time span=30m +| where distinct_cmdlines >= 8 +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `excessive_number_of_service_control_start_as_disabled_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. + +#### Required field + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Legitimate programs and administrators will execute sc.exe with the start disabled flag. It is possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time. + +#### Reference + + +* https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create + +* https://attack.mitre.org/techniques/T1562/001/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon.log + + _version_: 1
@@ -23069,7 +23386,7 @@ You must be populating the endpoint data model for SSA and specifically the proc | ID | Technique | Tactic | | ----------- | ----------- |--------------| | T1059 | Command and Scripting Interpreter | Execution | -| | | | +| T1117 | Regsvr32 | | | T1202 | Indirect Command Execution | Defense Evasion | @@ -23153,7 +23470,7 @@ To successfully implement this search you need to be ingesting information on pr | ID | Technique | Tactic | | ----------- | ----------- |--------------| | T1112 | Modify Registry | Defense Evasion | -| T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation | +| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -23240,7 +23557,7 @@ You must install splunk GCP add-on. This search works with gcp:pubsub:message lo | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -23424,6 +23741,84 @@ Limited false positives may be present in small environments. Tuning may be requ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log +_version_: 1 + + +--- + +### Grant Permission Using Cacls Utility +This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft, ransomware and coinminer scripts to evade detections and restrict access to their component files. + +- **Product**: Splunk Behavioral Analytics +- **Datamodel**: Endpoint +- **ATT&CK**: [T1222](https://attack.mitre.org/techniques/T1222/) +- **Last Updated**: 2021-06-14 + +
+ details + +#### Search +``` + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); +``` +#### Associated Analytic Story + +* XMRig + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. + +#### Required field + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1222 | File and Directory Permissions Modification | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network administrator may use this windows utility but this is not a common practice. + +#### Reference + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + + _version_: 1
@@ -24309,7 +24704,7 @@ You must be ingesting Windows Security logs from devices of interest, including | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1098 | Account Manipulation | Persistence | @@ -24541,7 +24936,7 @@ You must be ingesting Windows Security logs from devices of interest, including | ----------- | ----------- |--------------| | T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | | T1134 | Access Token Manipulation | Defense Evasion, Privilege Escalation | -| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -24616,7 +25011,7 @@ You must be ingesting Windows Security logs from devices of interest, including | ID | Technique | Tactic | | ----------- | ----------- |--------------| | T1134 | Access Token Manipulation | Defense Evasion, Privilege Escalation | -| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -25783,6 +26178,84 @@ administrators may use this command. Filter as needed. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log +_version_: 1 + + +--- + +### Modify ACLs Permission Of Files Or Folders +This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone or to a specific user. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner with appropriate permission. This behavior is a good indicator if this command seen on a machine utilized by an account with no permission to do so. + +- **Product**: Splunk Behavioral Analytics +- **Datamodel**: Endpoint +- **ATT&CK**: [T1222](https://attack.mitre.org/techniques/T1222/) +- **Last Updated**: 2021-06-15 + +
+ details + +#### Search +``` + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); +``` +#### Associated Analytic Story + +* XMRig + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. + +#### Required field + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1222 | File and Directory Permissions Modification | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network administrator may use this windows utility. filter is needed. + +#### Reference + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + + _version_: 1
@@ -26446,7 +26919,7 @@ This search is specific to Okta and requires Okta logs are being ingested in you | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.001 | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.001 | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -27017,7 +27490,7 @@ This searches show information on uploaded containers including source user, ima #### How To Implement -You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives. +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives. #### Required field @@ -28942,7 +29415,7 @@ This search is specific to Okta and requires Okta logs are being ingested in you | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.001 | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.001 | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -29009,7 +29482,7 @@ This search is specific to Okta and requires Okta logs are being ingested in you | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.001 | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.001 | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -29075,7 +29548,7 @@ This search is specific to Okta and requires Okta logs are being ingested in you | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078.001 | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078.001 | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -29141,7 +29614,7 @@ You must be ingesting data that records the filesystem activity from your hosts | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1546.008 | Accessibility Features | Persistence, Privilege Escalation | +| T1546.008 | Accessibility Features | Privilege Escalation, Persistence | #### Kill Chain Phase @@ -30213,6 +30686,165 @@ Administrators may modify the boot configuration ignore failure during testing a * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log +_version_: 1 + + +--- + +### Print Spooler Adding A Printer Driver +The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1547.012](https://attack.mitre.org/techniques/T1547/012/) +- **Last Updated**: 2021-07-01 + +
+ details + +#### Search +``` +`printservice` EventCode=316 category = "Adding a printer driver" Message = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" +| stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `print_spooler_adding_a_printer_driver_filter` +``` +#### Associated Analytic Story + +* PrintNightmare CVE-2021-34527 + + +#### How To Implement +You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. + +#### Required field + +* _time + +* OpCode + +* EventCode + +* ComputerName + +* Message + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1547.012 | Print Processors | Persistence, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Unknown. This may require filtering. + +#### Reference + + +* https://twitter.com/MalwareJake/status/1410421445608476679?s=20 + +* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + +* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + +* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_operational.log + + +_version_: 1 +
+ +--- + +### Print Spooler Failed to Load a Plug-in +The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ +The analytic is based on file path and failure to load the plug-in. \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1547.012](https://attack.mitre.org/techniques/T1547/012/) +- **Last Updated**: 2021-07-01 + +
+ details + +#### Search +``` +`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) +| stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `print_spooler_failed_to_load_a_plug_in_filter` +``` +#### Associated Analytic Story + +* PrintNightmare CVE-2021-34527 + + +#### How To Implement +You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. + +#### Required field + +* _time + +* OpCode + +* EventCode + +* ComputerName + +* Message + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1547.012 | Print Processors | Persistence, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +False positives are unknown and filtering may be required. + +#### Reference + + +* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + +* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + +* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes + + + +#### Test Dataset + + _version_: 1
@@ -30264,7 +30896,7 @@ You must be ingesting Windows Security logs from devices of interest, including | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1098 | Account Manipulation | Persistence | @@ -31350,7 +31982,7 @@ You must be ingesting Windows Security logs from devices of interest, including | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1087 | Account Discovery | Discovery | | T1484 | Domain Policy Modification | Defense Evasion, Privilege Escalation | @@ -31424,7 +32056,7 @@ You must be ingesting Windows Security logs from devices of interest, including | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1087 | Account Discovery | Discovery | | T1484 | Domain Policy Modification | Defense Evasion, Privilege Escalation | @@ -32023,10 +32655,10 @@ You must be ingesting Windows Security logs from devices of interest, including | ----------- | ----------- |--------------| | T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | | T1068 | Exploitation for Privilege Escalation | Privilege Escalation | -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1543 | Create or Modify System Process | Persistence, Privilege Escalation | | T1547 | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | -| T1574 | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation | +| T1574 | Hijack Execution Flow | Persistence, Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -32176,7 +32808,7 @@ You must be ingesting Windows Security logs from devices of interest, including | T1590.001 | Domain Properties | Reconnaissance | | T1590.003 | Network Trust Dependencies | Reconnaissance | | T1068 | Exploitation for Privilege Escalation | Privilege Escalation | -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1098 | Account Manipulation | Persistence | @@ -32323,7 +32955,7 @@ You must be ingesting Windows Security logs from devices of interest, including | ID | Technique | Tactic | | ----------- | ----------- |--------------| | T1068 | Exploitation for Privilege Escalation | Privilege Escalation | -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1098 | Account Manipulation | Persistence | @@ -32398,7 +33030,7 @@ You must be ingesting Windows Security logs from devices of interest, including | ----------- | ----------- |--------------| | T1543 | Create or Modify System Process | Persistence, Privilege Escalation | | T1055 | Process Injection | Defense Evasion, Privilege Escalation | -| T1574 | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation | +| T1574 | Hijack Execution Flow | Persistence, Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -32478,7 +33110,7 @@ To successfully implement this search, you must be ingesting data that records r | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1574.011 | Services Registry Permissions Weakness | Defense Evasion, Persistence, Privilege Escalation | +| T1574.011 | Services Registry Permissions Weakness | Persistence, Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -32634,7 +33266,7 @@ To successfully implement this search, you must be ingesting data that records r | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1546.012 | Image File Execution Options Injection | Persistence, Privilege Escalation | +| T1546.012 | Image File Execution Options Injection | Privilege Escalation, Persistence | #### Kill Chain Phase @@ -32710,7 +33342,7 @@ To successfully implement this search, you must populate the Change_Analysis dat | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1546.011 | Application Shimming | Persistence, Privilege Escalation | +| T1546.011 | Application Shimming | Privilege Escalation, Persistence | #### Kill Chain Phase @@ -33459,6 +34091,8 @@ The following analytic identifies rundll32.exe with no command line arguments an * Cobalt Strike +* PrintNightmare CVE-2021-34527 + #### How To Implement To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. @@ -33729,7 +34363,7 @@ To successfully implement this search you need to be ingesting information on pr | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation | +| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -33819,7 +34453,7 @@ To successfully implement this search you need to be ingesting information on pr | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation | +| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -34988,7 +35622,7 @@ To successfully implement this search, you will need to ensure that DNS data is | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | #### Kill Chain Phase @@ -35151,7 +35785,7 @@ You must be ingesting Windows Security logs from devices of interest, including | ID | Technique | Tactic | | ----------- | ----------- |--------------| | T1068 | Exploitation for Privilege Escalation | Privilege Escalation | -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1098 | Account Manipulation | Persistence | @@ -35227,7 +35861,7 @@ You must be ingesting Windows Security logs from devices of interest, including | ID | Technique | Tactic | | ----------- | ----------- |--------------| | T1068 | Exploitation for Privilege Escalation | Privilege Escalation | -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1098 | Account Manipulation | Persistence | @@ -35303,7 +35937,7 @@ You must be ingesting Windows Security logs from devices of interest, including | ID | Technique | Tactic | | ----------- | ----------- |--------------| | T1068 | Exploitation for Privilege Escalation | Privilege Escalation | -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | T1098 | Account Manipulation | Persistence | @@ -35378,7 +36012,7 @@ You must be ingesting data that records the filesystem activity from your hosts | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1546.011 | Application Shimming | Persistence, Privilege Escalation | +| T1546.011 | Application Shimming | Privilege Escalation, Persistence | #### Kill Chain Phase @@ -35448,7 +36082,7 @@ You must be ingesting data that records process activity from your hosts to popu | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1546.011 | Application Shimming | Persistence, Privilege Escalation | +| T1546.011 | Application Shimming | Privilege Escalation, Persistence | #### Kill Chain Phase @@ -35682,6 +36316,418 @@ _version_: 3 --- +### Spoolsv Spawning Rundll32 +The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1547.012](https://attack.mitre.org/techniques/T1547/012/) +- **Last Updated**: 2021-07-01 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe Processes.process_name=rundll32.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `spoolsv_spawning_rundll32_filter` +``` +#### Associated Analytic Story + +* PrintNightmare CVE-2021-34527 + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1547.012 | Print Processors | Persistence, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver. + +#### Reference + + +* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + +* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + +* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Spoolsv Suspicious Loaded Modules +This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1547.012](https://attack.mitre.org/techniques/T1547/012/) +- **Last Updated**: 2021-07-01 + +
+ details + +#### Search +``` +`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" +| stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer process_id EventCode +| where countImgloaded >= 3 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `spoolsv_suspicious_loaded_modules_filter` +``` +#### Associated Analytic Story + +* PrintNightmare CVE-2021-34527 + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* Image + +* Computer + +* EventCode + +* ImageLoaded + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1547.012 | Print Processors | Persistence, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Spoolsv Suspicious Process Access +This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made by the spoolsv.exe that may related to the attack. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1068](https://attack.mitre.org/techniques/T1068/) +- **Last Updated**: 2021-07-01 + +
+ details + +#### Search +``` +`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff +| stats count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage TargetImage GrantedAccess CallTrace EventCode ProcessID +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `spoolsv_suspicious_process_access_filter` +``` +#### Associated Analytic Story + +* PrintNightmare CVE-2021-34527 + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with process access event where SourceImage, TargetImage, GrantedAccess and CallTrace executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of spoolsv.exe. + +#### Required field + +* _time + +* SourceImage + +* TargetImage + +* GrantedAccess + +* CallTrace + +* EventCode + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1068 | Exploitation for Privilege Escalation | Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Unknown. Filter as needed. + +#### Reference + + +* https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818 + +* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + +* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + +* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Spoolsv Writing a DLL +The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1547.012](https://attack.mitre.org/techniques/T1547/012/) +- **Last Updated**: 2021-07-01 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=spoolsv.exe by _time Processes.process_id Processes.process_name Processes.dest +| `drop_dm_object_name(Processes)` +| join process_guid, _time [ +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*" Filesystem.file_name="*.dll" by _time Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path +| `drop_dm_object_name(Filesystem)` +| fields _time dest file_create_time file_name file_path process_name process_path process] +| dedup file_create_time +| table dest file_create_time, file_name, file_path, process_name +| `spoolsv_writing_a_dll_filter` +``` +#### Associated Analytic Story + +* PrintNightmare CVE-2021-34527 + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. + +#### Required field + +* _time + +* Filesystem.dest + +* Filesystem.file_create_time + +* Filesystem.file_name + +* Filesystem.file_path + +* Processes.process_name + +* Processes.process_id + +* Processes.process_name + +* Processes.dest + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1547.012 | Print Processors | Persistence, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Unknown. + +#### Reference + + +* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + +* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + +* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Spoolsv Writing a DLL - Sysmon +The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1547.012](https://attack.mitre.org/techniques/T1547/012/) +- **Last Updated**: 2021-07-01 + +
+ details + +#### Search +``` +`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*" file_name=*.dll +| stats count min(_time) as firstTime max(_time) as lastTime by dest, UserID, process_name, file_path, file_name, TargetFilename, process_id +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `spoolsv_writing_a_dll___sysmon_filter` +``` +#### Associated Analytic Story + +* PrintNightmare CVE-2021-34527 + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. + +#### Required field + +* _time + +* dest + +* UserID + +* process_name + +* file_path + +* file_name + +* TargetFilename + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1547.012 | Print Processors | Persistence, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Limited false positives. Filter as needed. + +#### Reference + + +* https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818 + +* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + +* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + +* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Start Up During Safe Mode Boot This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. @@ -35957,7 +37003,7 @@ To successfully implement this search you need to be ingesting information on pr | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1105 | Ingress Tool Transfer | Command and Control | +| T1105 | Ingress Tool Transfer | Command And Control | #### Kill Chain Phase @@ -37351,6 +38397,8 @@ The following analytic identifies rundll32.exe with no command line arguments. I * Cobalt Strike +* PrintNightmare CVE-2021-34527 + #### How To Implement To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -38559,7 +39607,7 @@ In order to properly run this search, Splunk needs to ingest data from firewalls | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1071.001 | Web Protocols | Command and Control | +| T1071.001 | Web Protocols | Command And Control | #### Kill Chain Phase @@ -38900,7 +39948,7 @@ _version_: 3 ### Unloading AMSI via Reflection The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ -This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ +This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -39551,7 +40599,7 @@ To successfully implement this search, you must be collecting Sysmon data using | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1546.003 | Windows Management Instrumentation Event Subscription | Persistence, Privilege Escalation | +| T1546.003 | Windows Management Instrumentation Event Subscription | Privilege Escalation, Persistence | #### Kill Chain Phase @@ -40130,6 +41178,168 @@ unknown * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log +_version_: 1 + + +--- + +### WevtUtil Usage To Clear Logs +The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, or system event logs. + +- **Product**: Splunk Behavioral Analytics +- **Datamodel**: Endpoint +- **ATT&CK**: [T1070.001](https://attack.mitre.org/techniques/T1070/001/) +- **Last Updated**: 2021-06-15 + +
+ details + +#### Search +``` + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); +``` +#### Associated Analytic Story + +* Windows Log Manipulation + +* Ransomware + +* Clop Ransomware + + +#### How To Implement +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. + +#### Required field + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1070.001 | Clear Windows Event Logs | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. + +#### Reference + + +* https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log + + +_version_: 1 +
+ +--- + +### Wevtutil Usage To Disable Logs +This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections in compromised host. + +- **Product**: Splunk Behavioral Analytics +- **Datamodel**: Endpoint +- **ATT&CK**: [T1070.001](https://attack.mitre.org/techniques/T1070/001/) +- **Last Updated**: 2021-06-15 + +
+ details + +#### Search +``` + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); +``` +#### Associated Analytic Story + +* Windows Log Manipulation + +* Ransomware + + +#### How To Implement +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. + +#### Required field + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1070.001 | Clear Windows Event Logs | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network operator may disable audit event logs for debugging purposes. + +#### Reference + + +* https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + + _version_: 1
@@ -41152,7 +42362,7 @@ You must install splunk AWS add-on and Splunk App for AWS. This search works wit | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -41231,7 +42441,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -41322,7 +42532,7 @@ You must install splunk AWS add-on and Splunk App for AWS. This search works wit | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase @@ -41367,7 +42577,7 @@ This search provides detection of suspicious use of sts:AssumeRole. These tokens #### How To Implement -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs #### Required field @@ -41401,7 +42611,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | #### Kill Chain Phase diff --git a/docs/detections.wiki b/docs/detections.wiki index 469af68926..3ec0522a32 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -414,7 +414,7 @@ This search is specific to Okta and requires Okta logs are being ingested in you |- | T1078.001 | Default Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -546,7 +546,7 @@ This search is specific to Okta and requires Okta logs are being ingested in you |- | T1078.001 | Default Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -618,7 +618,7 @@ This search is specific to Okta and requires Okta logs are being ingested in you |- | T1078.001 | Default Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -689,7 +689,7 @@ This search is specific to Okta and requires Okta logs are being ingested in you |- | T1078.001 | Default Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -1007,7 +1007,7 @@ Some of these processes may be used legitimately on web servers during maintenan ===Aws create policy version to allow all resources=== -This search looks for CloudTrail events where a user created a policy version that allows them to access any resource in their account +This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': @@ -1034,7 +1034,7 @@ This search looks for CloudTrail events where a user created a policy version th ====How To Implement==== -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. ====Required field==== @@ -1058,7 +1058,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit |- | T1078.004 | Cloud Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -1091,7 +1091,7 @@ While this search has no known false positives, it is possible that an AWS admin ---- ===Aws createaccesskey=== -This search looks for CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': @@ -1115,7 +1115,7 @@ This search looks for CloudTrail events where a user A who has already permissio ====How To Implement==== -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. ====Required field==== @@ -1172,7 +1172,7 @@ While this search has no known false positives, it is possible that an AWS admin ---- ===Aws createloginprofile=== -This search looks for CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip +This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': @@ -1200,7 +1200,7 @@ This search looks for CloudTrail events where a user A(victim A) creates a login ====How To Implement==== -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. ====Required field==== @@ -1359,7 +1359,7 @@ This search provides detection of KMS keys which action kms:Encrypt is accessibl ====How To Implement==== -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs ====Required field==== @@ -1444,7 +1444,7 @@ This search provides detection of users with KMS keys performing encryption spec ====How To Implement==== -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs ====Required field==== @@ -1507,7 +1507,7 @@ bucket with S3 encryption ---- ===Aws excessive security scanning=== -This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. +This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': @@ -1531,7 +1531,7 @@ This search looks for CloudTrail events and analyse the amount of eventNames whi ====How To Implement==== -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. ====Required field==== @@ -2001,7 +2001,7 @@ This detection will require tuning to provide high fidelity detection capabiltie ---- ===Aws network access control list created with all open ports=== -The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. +The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': @@ -2028,7 +2028,7 @@ The search looks for CloudTrail events to detect if any network ACLs were create ====How To Implement==== -You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail inputs. +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs. ====Required field==== @@ -2091,7 +2091,7 @@ It's possible that an admin has created this ACL with all ports open for some le ---- ===Aws network access control list deleted=== -Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs. +Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': @@ -2115,7 +2115,7 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo ====How To Implement==== -You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. ====Required field==== @@ -2193,7 +2193,7 @@ This search provides specific SAML access from specific Service Provider, user a ====How To Implement==== -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs ====Required field==== @@ -2225,7 +2225,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -2283,7 +2283,7 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA ====How To Implement==== -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. ====Required field==== @@ -2313,7 +2313,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -2348,7 +2348,7 @@ Updating a SAML provider or creating a new one may not necessarily be malicious ---- ===Aws setdefaultpolicyversion=== -This search looks for CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy +This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': @@ -2371,7 +2371,7 @@ This search looks for CloudTrail events where a user has set a default policy ve ====How To Implement==== -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. ====Required field==== @@ -2397,7 +2397,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit |- | T1078.004 | Cloud Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -2430,7 +2430,7 @@ While this search has no known false positives, it is possible that an AWS admin ---- ===Aws updateloginprofile=== -This search looks for CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) +This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': @@ -2454,7 +2454,7 @@ This search looks for CloudTrail events where a user A who has already permissio ====How To Implement==== -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. ====Required field==== @@ -2568,7 +2568,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base |- | T1078.004 | Cloud Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -2655,7 +2655,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base |- | T1078.004 | Cloud Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -2742,7 +2742,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base |- | T1078.004 | Cloud Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -2826,7 +2826,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base |- | T1078.004 | Cloud Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -3081,7 +3081,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -3159,7 +3159,7 @@ You must be ingesting the appropriate cloud-infrastructure logs Run the "Previou |- | T1078.004 | Cloud Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -3459,7 +3459,7 @@ This search has a dependency on other searches to create and update a baseline o |- | T1078.004 | Cloud Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -3543,7 +3543,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -3628,7 +3628,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -3711,7 +3711,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -3796,7 +3796,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -3822,7 +3822,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif ---- ===Detect aws console login by new user=== -This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Authentication @@ -3850,7 +3850,7 @@ This search looks for CloudTrail events wherein a console login event by a user ====How To Implement==== -You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. ====Required field==== @@ -3886,7 +3886,7 @@ When a legitimate new user logins for the first time, this activity will be dete ---- ===Detect aws console login by user from new city=== -This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Authentication @@ -3922,7 +3922,7 @@ This search looks for CloudTrail events wherein a console login event by a user ====How To Implement==== -You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. ====Required field==== @@ -3971,7 +3971,7 @@ When a legitimate new user logins for the first time, this activity will be dete ---- ===Detect aws console login by user from new country=== -This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Authentication @@ -4007,7 +4007,7 @@ This search looks for CloudTrail events wherein a console login event by a user ====How To Implement==== -You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. ====Required field==== @@ -4056,7 +4056,7 @@ When a legitimate new user logins for the first time, this activity will be dete ---- ===Detect aws console login by user from new region=== -This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour +This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Authentication @@ -4092,7 +4092,7 @@ This search looks for CloudTrail events wherein a console login event by a user ====How To Implement==== -You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. ====Required field==== @@ -4317,7 +4317,7 @@ While this search has no known false positives, it is possible that a GCP admin ---- ===Detect new open s3 buckets over aws cli=== -This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': @@ -4407,7 +4407,7 @@ While this search has no known false positives, it is possible that an AWS admin ---- ===Detect new open s3 buckets=== -This search looks for CloudTrail events where a user has created an open/public S3 bucket. +This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': @@ -4749,7 +4749,7 @@ This search detects users creating spikes in API activity related to deletion of ====How To Implement==== -You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity. +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity. ====Required field==== @@ -4924,7 +4924,7 @@ You must install splunk GCP add-on. This search works with gcp:pubsub:message lo |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -5204,7 +5204,7 @@ This searches show information on uploaded containers including source user, ima ====How To Implement==== -You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives. +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives. ====Required field==== @@ -6215,7 +6215,7 @@ You must install splunk AWS add-on and Splunk App for AWS. This search works wit |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -6299,7 +6299,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -6395,7 +6395,7 @@ You must install splunk AWS add-on and Splunk App for AWS. This search works wit |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -6441,7 +6441,7 @@ This search provides detection of suspicious use of sts:AssumeRole. These tokens ====How To Implement==== -You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs ====Required field==== @@ -6479,7 +6479,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -6982,7 +6982,7 @@ To successfully implement this search, you must be ingesting data that records r |- | T1548 | Abuse Elevation Control Mechanism -| Defense Evasion, Privilege Escalation +| Privilege Escalation, Defense Evasion |} @@ -7351,7 +7351,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1098 | Account Manipulation @@ -7371,7 +7371,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1548 | Abuse Elevation Control Mechanism -| Defense Evasion, Privilege Escalation +| Privilege Escalation, Defense Evasion |- | T1554 | Compromise Client Software Binary @@ -7472,7 +7472,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1098 | Account Manipulation @@ -7492,7 +7492,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1548 | Abuse Elevation Control Mechanism -| Defense Evasion, Privilege Escalation +| Privilege Escalation, Defense Evasion |- | T1554 | Compromise Client Software Binary @@ -7583,7 +7583,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1098 | Account Manipulation @@ -8172,7 +8172,7 @@ To successfully implement this search you need to be ingesting information on pr |- | T1105 | Ingress Tool Transfer -| Command and Control +| Command And Control |} @@ -8517,7 +8517,7 @@ To successfully implement this search you need to be ingesting information on pr |- | T1105 | Ingress Tool Transfer -| Command and Control +| Command And Control |} @@ -8604,7 +8604,7 @@ To successfully implement this search you need to be ingesting information on pr |- | T1105 | Ingress Tool Transfer -| Command and Control +| Command And Control |} @@ -11578,6 +11578,89 @@ vssadmin.exe and wmic.exe are standard applications shipped with modern versions ---- +===Deny permission using cacls utility=== +This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection and prevent access to their component files. + +* '''Product''': Splunk Behavioral Analytics +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1222/ T1222] +* '''Last Updated''': 2021-06-14 + +
+
+ +====Search==== + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#XMRig|XMRig]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. + +====Required field==== + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1222 +| File and Directory Permissions Modification +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network administrator may use this windows utility but this is not a common practice. + +====Reference==== + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + + +''version'': 1 +
+
+ +---- + ===Detect activity related to pass the hash attacks=== This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. @@ -12450,7 +12533,7 @@ If Splunk>Phantom is also configured in your environment, a Playbook called "Exc |- | T1078.002 | Domain Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -12525,7 +12608,7 @@ ou must ingest your Windows security event logs in the `Change` datamodel under |- | T1078.003 | Local Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -13670,7 +13753,7 @@ You must be ingesting data that records process activity from your hosts to popu |- | T1574.009 | Path Interception by Unquoted Path -| Defense Evasion, Persistence, Privilege Escalation +| Persistence, Privilege Escalation, Defense Evasion |} @@ -15945,7 +16028,7 @@ To successfully implement this search, you need to be ingesting logs with that p |- | T1546.003 | Windows Management Instrumentation Event Subscription -| Persistence, Privilege Escalation +| Privilege Escalation, Persistence |} @@ -17396,7 +17479,7 @@ To successfully implement this search, you must be ingesting data that records r |- | T1548.002 | Bypass User Account Control -| Defense Evasion, Privilege Escalation +| Privilege Escalation, Defense Evasion |} @@ -17646,7 +17729,7 @@ To successfully implement this search, you need to be ingesting logs with the pr |- | T1105 | Ingress Tool Transfer -| Command and Control +| Command And Control |} @@ -18157,7 +18240,7 @@ To successfully implement this search you need to be ingesting information on pr |- | T1548.002 | Bypass User Account Control -| Defense Evasion, Privilege Escalation +| Privilege Escalation, Defense Evasion |} @@ -18954,6 +19037,94 @@ Many benign applications will create processes from executables in Windows\Temp, * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/windows_temp_processes/logExcessiveWindowsTemp.log +''version'': 1 + + + +---- + +===Excessive number of service control start as disabled=== +This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''Last Updated''': 2021-06-25 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` distinct_count(Processes.process) as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_id, _time span=30m +| where distinct_cmdlines >= 8 +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `excessive_number_of_service_control_start_as_disabled_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Legitimate programs and administrators will execute sc.exe with the start disabled flag. It is possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time. + +====Reference==== + + +* https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create + +* https://attack.mitre.org/techniques/T1562/001/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon.log + + ''version'': 1
@@ -19523,7 +19694,7 @@ This search looks for command-line arguments that use a `/c` parameter to execut * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], , [https://attack.mitre.org/techniques/T1202/ T1202] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1117/ T1117], [https://attack.mitre.org/techniques/T1202/ T1202] * '''Last Updated''': 2021-2-1
@@ -19575,8 +19746,8 @@ You must be populating the endpoint data model for SSA and specifically the proc | Command and Scripting Interpreter | Execution |- -| -| +| T1117 +| Regsvr32 | |- | T1202 @@ -19672,7 +19843,7 @@ To successfully implement this search you need to be ingesting information on pr |- | T1548.002 | Bypass User Account Control -| Defense Evasion, Privilege Escalation +| Privilege Escalation, Defense Evasion |} @@ -19795,6 +19966,89 @@ Limited false positives may be present in small environments. Tuning may be requ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log +''version'': 1 +
+ + +---- + +===Grant permission using cacls utility=== +This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft, ransomware and coinminer scripts to evade detections and restrict access to their component files. + +* '''Product''': Splunk Behavioral Analytics +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1222/ T1222] +* '''Last Updated''': 2021-06-14 + +
+
+ +====Search==== + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#XMRig|XMRig]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. + +====Required field==== + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1222 +| File and Directory Permissions Modification +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network administrator may use this windows utility but this is not a common practice. + +====Reference==== + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + + ''version'': 1
@@ -20590,7 +20844,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1098 | Account Manipulation @@ -20858,7 +21112,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1548 | Abuse Elevation Control Mechanism -| Defense Evasion, Privilege Escalation +| Privilege Escalation, Defense Evasion |} @@ -20941,7 +21195,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1548 | Abuse Elevation Control Mechanism -| Defense Evasion, Privilege Escalation +| Privilege Escalation, Defense Evasion |} @@ -22052,6 +22306,89 @@ administrators may use this command. Filter as needed. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log +''version'': 1 + + + +---- + +===Modify acls permission of files or folders=== +This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone or to a specific user. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner with appropriate permission. This behavior is a good indicator if this command seen on a machine utilized by an account with no permission to do so. + +* '''Product''': Splunk Behavioral Analytics +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1222/ T1222] +* '''Last Updated''': 2021-06-15 + +
+
+ +====Search==== + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#XMRig|XMRig]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. + +====Required field==== + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1222 +| File and Directory Permissions Modification +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network administrator may use this windows utility. filter is needed. + +====Reference==== + + +* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + + ''version'': 1
@@ -24046,7 +24383,7 @@ You must be ingesting data that records the filesystem activity from your hosts |- | T1546.008 | Accessibility Features -| Persistence, Privilege Escalation +| Privilege Escalation, Persistence |} @@ -25039,6 +25376,175 @@ Administrators may modify the boot configuration ignore failure during testing a * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log +''version'': 1 + + + +---- + +===Print spooler adding a printer driver=== +The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012] +* '''Last Updated''': 2021-07-01 + +
+
+ +====Search==== +`printservice` EventCode=316 category = "Adding a printer driver" Message = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" +| stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `print_spooler_adding_a_printer_driver_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#PrintNightmare_CVE-2021-34527|PrintNightmare CVE-2021-34527]] + + +====How To Implement==== +You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. + +====Required field==== + +* _time + +* OpCode + +* EventCode + +* ComputerName + +* Message + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1547.012 +| Print Processors +| Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Unknown. This may require filtering. + +====Reference==== + + +* https://twitter.com/MalwareJake/status/1410421445608476679?s=20 + +* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + +* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + +* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_operational.log + + +''version'': 1 +
+
+ +---- + +===Print spooler failed to load a plug-in=== +The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ +Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ +The analytic is based on file path and failure to load the plug-in. \ +During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012] +* '''Last Updated''': 2021-07-01 + +
+
+ +====Search==== +`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) +| stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `print_spooler_failed_to_load_a_plug_in_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#PrintNightmare_CVE-2021-34527|PrintNightmare CVE-2021-34527]] + + +====How To Implement==== +You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. + +====Required field==== + +* _time + +* OpCode + +* EventCode + +* ComputerName + +* Message + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1547.012 +| Print Processors +| Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +False positives are unknown and filtering may be required. + +====Reference==== + + +* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + +* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + +* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes + + + +====Test Dataset==== + + ''version'': 1
@@ -25094,7 +25600,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1098 | Account Manipulation @@ -26030,7 +26536,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1087 | Account Discovery @@ -26115,7 +26621,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1087 | Account Discovery @@ -26823,7 +27329,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1543 | Create or Modify System Process @@ -26835,7 +27341,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1574 | Hijack Execution Flow -| Defense Evasion, Persistence, Privilege Escalation +| Persistence, Privilege Escalation, Defense Evasion |} @@ -27013,7 +27519,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1098 | Account Manipulation @@ -27179,7 +27685,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1098 | Account Manipulation @@ -27268,7 +27774,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1574 | Hijack Execution Flow -| Defense Evasion, Persistence, Privilege Escalation +| Persistence, Privilege Escalation, Defense Evasion |} @@ -27353,7 +27859,7 @@ To successfully implement this search, you must be ingesting data that records r |- | T1574.011 | Services Registry Permissions Weakness -| Defense Evasion, Persistence, Privilege Escalation +| Persistence, Privilege Escalation, Defense Evasion |} @@ -27519,7 +28025,7 @@ To successfully implement this search, you must be ingesting data that records r |- | T1546.012 | Image File Execution Options Injection -| Persistence, Privilege Escalation +| Privilege Escalation, Persistence |} @@ -27600,7 +28106,7 @@ To successfully implement this search, you must populate the Change_Analysis dat |- | T1546.011 | Application Shimming -| Persistence, Privilege Escalation +| Privilege Escalation, Persistence |} @@ -28234,6 +28740,8 @@ The following analytic identifies rundll32.exe with no command line arguments an * [[Documentation:ESSOC:stories:UseCase#Cobalt_Strike|Cobalt Strike]] +* [[Documentation:ESSOC:stories:UseCase#PrintNightmare_CVE-2021-34527|PrintNightmare CVE-2021-34527]] + ====How To Implement==== To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. @@ -28523,7 +29031,7 @@ To successfully implement this search you need to be ingesting information on pr |- | T1548.002 | Bypass User Account Control -| Defense Evasion, Privilege Escalation +| Privilege Escalation, Defense Evasion |} @@ -28618,7 +29126,7 @@ To successfully implement this search you need to be ingesting information on pr |- | T1548.002 | Bypass User Account Control -| Defense Evasion, Privilege Escalation +| Privilege Escalation, Defense Evasion |} @@ -29616,7 +30124,7 @@ To successfully implement this search, you will need to ensure that DNS data is |- | T1548 | Abuse Elevation Control Mechanism -| Defense Evasion, Privilege Escalation +| Privilege Escalation, Defense Evasion |} @@ -29792,7 +30300,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1098 | Account Manipulation @@ -29879,7 +30387,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1098 | Account Manipulation @@ -29966,7 +30474,7 @@ You must be ingesting Windows Security logs from devices of interest, including |- | T1078 | Valid Accounts -| Defense Evasion, Initial Access, Persistence, Privilege Escalation +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |- | T1098 | Account Manipulation @@ -30049,7 +30557,7 @@ You must be ingesting data that records the filesystem activity from your hosts |- | T1546.011 | Application Shimming -| Persistence, Privilege Escalation +| Privilege Escalation, Persistence |} @@ -30124,7 +30632,7 @@ You must be ingesting data that records process activity from your hosts to popu |- | T1546.011 | Application Shimming -| Persistence, Privilege Escalation +| Privilege Escalation, Persistence |} @@ -30370,6 +30878,443 @@ It is important to understand that if you happen to install any new applications ---- +===Spoolsv spawning rundll32=== +The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012] +* '''Last Updated''': 2021-07-01 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe Processes.process_name=rundll32.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `spoolsv_spawning_rundll32_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#PrintNightmare_CVE-2021-34527|PrintNightmare CVE-2021-34527]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1547.012 +| Print Processors +| Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver. + +====Reference==== + + +* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + +* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + +* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Spoolsv suspicious loaded modules=== +This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012] +* '''Last Updated''': 2021-07-01 + +
+
+ +====Search==== +`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" +| stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer process_id EventCode +| where countImgloaded >= 3 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `spoolsv_suspicious_loaded_modules_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#PrintNightmare_CVE-2021-34527|PrintNightmare CVE-2021-34527]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* Image + +* Computer + +* EventCode + +* ImageLoaded + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1547.012 +| Print Processors +| Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Spoolsv suspicious process access=== +This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made by the spoolsv.exe that may related to the attack. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1068/ T1068] +* '''Last Updated''': 2021-07-01 + +
+
+ +====Search==== +`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff +| stats count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage TargetImage GrantedAccess CallTrace EventCode ProcessID +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `spoolsv_suspicious_process_access_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#PrintNightmare_CVE-2021-34527|PrintNightmare CVE-2021-34527]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with process access event where SourceImage, TargetImage, GrantedAccess and CallTrace executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of spoolsv.exe. + +====Required field==== + +* _time + +* SourceImage + +* TargetImage + +* GrantedAccess + +* CallTrace + +* EventCode + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1068 +| Exploitation for Privilege Escalation +| Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Unknown. Filter as needed. + +====Reference==== + + +* https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818 + +* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + +* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + +* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Spoolsv writing a dll=== +The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012] +* '''Last Updated''': 2021-07-01 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=spoolsv.exe by _time Processes.process_id Processes.process_name Processes.dest +| `drop_dm_object_name(Processes)` +| join process_guid, _time [ +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*" Filesystem.file_name="*.dll" by _time Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path +| `drop_dm_object_name(Filesystem)` +| fields _time dest file_create_time file_name file_path process_name process_path process] +| dedup file_create_time +| table dest file_create_time, file_name, file_path, process_name +| `spoolsv_writing_a_dll_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#PrintNightmare_CVE-2021-34527|PrintNightmare CVE-2021-34527]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. + +====Required field==== + +* _time + +* Filesystem.dest + +* Filesystem.file_create_time + +* Filesystem.file_name + +* Filesystem.file_path + +* Processes.process_name + +* Processes.process_id + +* Processes.process_name + +* Processes.dest + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1547.012 +| Print Processors +| Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Unknown. + +====Reference==== + + +* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + +* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + +* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Spoolsv writing a dll - sysmon=== +The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012] +* '''Last Updated''': 2021-07-01 + +
+
+ +====Search==== +`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*" file_name=*.dll +| stats count min(_time) as firstTime max(_time) as lastTime by dest, UserID, process_name, file_path, file_name, TargetFilename, process_id +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `spoolsv_writing_a_dll___sysmon_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#PrintNightmare_CVE-2021-34527|PrintNightmare CVE-2021-34527]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. + +====Required field==== + +* _time + +* dest + +* UserID + +* process_name + +* file_path + +* file_name + +* TargetFilename + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1547.012 +| Print Processors +| Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Limited false positives. Filter as needed. + +====Reference==== + + +* https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818 + +* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + +* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + +* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Start up during safe mode boot=== This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. @@ -30583,7 +31528,7 @@ To successfully implement this search you need to be ingesting information on pr |- | T1105 | Ingress Tool Transfer -| Command and Control +| Command And Control |} @@ -31911,6 +32856,8 @@ The following analytic identifies rundll32.exe with no command line arguments. I * [[Documentation:ESSOC:stories:UseCase#Cobalt_Strike|Cobalt Strike]] +* [[Documentation:ESSOC:stories:UseCase#PrintNightmare_CVE-2021-34527|PrintNightmare CVE-2021-34527]] + ====How To Implement==== To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -33481,7 +34428,7 @@ You must be ingesting data that records process activity from your hosts to popu ===Unloading amsi via reflection=== The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ -This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ +This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -34092,7 +35039,7 @@ To successfully implement this search, you must be collecting Sysmon data using |- | T1546.003 | Windows Management Instrumentation Event Subscription -| Persistence, Privilege Escalation +| Privilege Escalation, Persistence |} @@ -34632,6 +35579,178 @@ unknown * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log +''version'': 1 + + + +---- + +===Wevtutil usage to clear logs=== +The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, or system event logs. + +* '''Product''': Splunk Behavioral Analytics +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/001/ T1070.001] +* '''Last Updated''': 2021-06-15 + +
+
+ +====Search==== + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Log_Manipulation|Windows Log Manipulation]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Clop_Ransomware|Clop Ransomware]] + + +====How To Implement==== +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. + +====Required field==== + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1070.001 +| Clear Windows Event Logs +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. + +====Reference==== + + +* https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log + + +''version'': 1 +
+
+ +---- + +===Wevtutil usage to disable logs=== +This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections in compromised host. + +* '''Product''': Splunk Behavioral Analytics +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/001/ T1070.001] +* '''Last Updated''': 2021-06-15 + +
+
+ +====Search==== + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +| into write_ssa_detected_events(); + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Log_Manipulation|Windows Log Manipulation]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. + +====Required field==== + +* _time + +* dest_device_id + +* process_name + +* parent_process_name + +* process_path + +* dest_user_id + +* process + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1070.001 +| Clear Windows Event Logs +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network operator may disable audit event logs for debugging purposes. + +====Reference==== + + +* https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + + ''version'': 1
@@ -35748,7 +36867,7 @@ Detailed documentation on how to create a new field within Incident Review may b |- | T1071.004 | DNS -| Command and Control +| Command And Control |} @@ -35911,7 +37030,7 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne |- | T1557.002 | ARP Cache Poisoning -| Collection, Credential Access +| Credential Access, Collection |} @@ -36010,7 +37129,7 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne |- | T1557.002 | ARP Cache Poisoning -| Collection, Credential Access +| Credential Access, Collection |} @@ -36112,7 +37231,7 @@ In order to run this search effectively, we highly recommend that you leverage t |- | T1095 | Non-Application Layer Protocol -| Command and Control +| Command And Control |} @@ -36195,7 +37314,7 @@ In order to run this search effectively, we highly recommend that you leverage t |- | T1071.002 | File Transfer Protocols -| Command and Control +| Command And Control |} @@ -36290,7 +37409,7 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne |- | T1557.002 | ARP Cache Poisoning -| Collection, Credential Access +| Credential Access, Collection |} @@ -36378,7 +37497,7 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne |- | T1557 | Man-in-the-Middle -| Collection, Credential Access +| Credential Access, Collection |} @@ -37093,7 +38212,7 @@ To successfully implement this search you must ensure that DNS data is populatin |- | T1071.004 | DNS -| Command and Control +| Command And Control |} @@ -38048,7 +39167,7 @@ In order to properly run this search, Splunk needs to ingest data from firewalls |- | T1071.001 | Web Protocols -| Command and Control +| Command And Control |} @@ -38577,7 +39696,7 @@ There might be false positives associted with this detection since items like ar 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-# On Date: 2021-06-24 18:14:07.310619 UTC''
+# On Date: 2021-07-02 15:57:11.009427 UTC''
 # Author: Splunk Security Research''
 # Contact: research@splunk.com''
 #############
diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv
index 245ef83f89..9e952cd291 100644
--- a/docs/mitre-map/coverage.csv
+++ b/docs/mitre-map/coverage.csv
@@ -143,9 +143,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -207,7 +207,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -285,7 +290,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -425,17 +430,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -533,8 +543,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -705,24 +715,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -763,15 +774,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -818,8 +830,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -1216,9 +1228,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -1280,7 +1292,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -1358,7 +1375,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -1498,17 +1515,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -1606,8 +1628,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -1778,24 +1800,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -1836,15 +1859,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -1891,8 +1915,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -2289,9 +2313,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -2353,7 +2377,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -2431,7 +2460,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -2571,17 +2600,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -2679,8 +2713,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -2851,24 +2885,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -2909,15 +2944,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -2964,8 +3000,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -3362,9 +3398,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -3426,7 +3462,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -3504,7 +3545,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -3644,17 +3685,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -3752,8 +3798,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -3924,24 +3970,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -3982,15 +4029,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -4037,8 +4085,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -4435,9 +4483,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -4499,7 +4547,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -4577,7 +4630,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -4717,17 +4770,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -4825,8 +4883,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -4997,24 +5055,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -5055,15 +5114,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -5110,8 +5170,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -5508,9 +5568,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -5572,7 +5632,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -5650,7 +5715,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -5790,17 +5855,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -5898,8 +5968,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -6070,24 +6140,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -6128,15 +6199,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -6183,8 +6255,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -6581,9 +6653,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -6645,7 +6717,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -6723,7 +6800,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -6863,17 +6940,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -6971,8 +7053,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -7143,24 +7225,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -7201,15 +7284,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -7256,8 +7340,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -7654,9 +7738,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -7718,7 +7802,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -7796,7 +7885,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -7936,17 +8025,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -8044,8 +8138,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -8216,24 +8310,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -8274,15 +8369,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -8329,8 +8425,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -8727,9 +8823,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -8791,7 +8887,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -8869,7 +8970,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -9009,17 +9110,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -9117,8 +9223,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -9289,24 +9395,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -9347,15 +9454,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -9402,8 +9510,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -9800,9 +9908,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -9864,7 +9972,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -9942,7 +10055,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -10082,17 +10195,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -10190,8 +10308,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -10362,24 +10480,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -10420,15 +10539,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -10475,8 +10595,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -10873,9 +10993,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -10937,7 +11057,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -11015,7 +11140,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -11155,17 +11280,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -11263,8 +11393,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -11435,24 +11565,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -11493,15 +11624,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -11548,8 +11680,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -11946,9 +12078,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -12010,7 +12142,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -12088,7 +12225,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -12228,17 +12365,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -12336,8 +12478,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -12508,24 +12650,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -12566,15 +12709,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -12621,8 +12765,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -13019,9 +13163,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -13083,7 +13227,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -13161,7 +13310,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -13301,17 +13450,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -13409,8 +13563,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -13581,24 +13735,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -13639,15 +13794,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -13694,8 +13850,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -14092,9 +14248,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -14156,7 +14312,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -14234,7 +14395,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -14374,17 +14535,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -14482,8 +14648,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -14654,24 +14820,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -14712,15 +14879,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -14767,8 +14935,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -15165,9 +15333,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -15229,7 +15397,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -15307,7 +15480,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -15447,17 +15620,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -15555,8 +15733,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -15727,24 +15905,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -15785,15 +15964,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -15840,8 +16020,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -16238,9 +16418,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -16302,7 +16482,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -16380,7 +16565,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -16520,17 +16705,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -16628,8 +16818,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -16800,24 +16990,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -16858,15 +17049,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -16913,8 +17105,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -17311,9 +17503,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -17375,7 +17567,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -17453,7 +17650,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -17593,17 +17790,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -17701,8 +17903,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -17873,24 +18075,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -17931,15 +18134,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -17986,8 +18190,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -18384,9 +18588,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -18448,7 +18652,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -18526,7 +18735,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -18666,17 +18875,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -18774,8 +18988,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -18946,24 +19160,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -19004,15 +19219,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -19059,8 +19275,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -19457,9 +19673,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -19521,7 +19737,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -19599,7 +19820,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -19739,17 +19960,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -19847,8 +20073,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -20019,24 +20245,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -20077,15 +20304,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -20132,8 +20360,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -20530,9 +20758,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -20594,7 +20822,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -20672,7 +20905,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -20812,17 +21045,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -20920,8 +21158,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -21092,24 +21330,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -21150,15 +21389,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -21205,8 +21445,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -21603,9 +21843,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -21667,7 +21907,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -21745,7 +21990,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -21885,17 +22130,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -21993,8 +22243,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -22165,24 +22415,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -22223,15 +22474,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -22278,8 +22530,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -22676,9 +22928,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -22740,7 +22992,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -22818,7 +23075,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -22958,17 +23215,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -23066,8 +23328,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -23238,24 +23500,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -23296,15 +23559,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -23351,8 +23615,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -23749,9 +24013,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -23813,7 +24077,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -23891,7 +24160,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -24031,17 +24300,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -24139,8 +24413,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -24311,24 +24585,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -24369,15 +24644,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -24424,8 +24700,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -24822,9 +25098,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -24886,7 +25162,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -24964,7 +25245,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -25104,17 +25385,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -25212,8 +25498,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -25384,24 +25670,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -25442,15 +25729,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -25497,8 +25785,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -25895,9 +26183,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -25959,7 +26247,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -26037,7 +26330,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -26177,17 +26470,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -26285,8 +26583,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -26457,24 +26755,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -26515,15 +26814,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -26570,8 +26870,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -26968,9 +27268,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -27032,7 +27332,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -27110,7 +27415,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -27250,17 +27555,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -27358,8 +27668,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -27530,24 +27840,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -27588,15 +27899,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -27643,8 +27955,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -28041,9 +28353,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -28105,7 +28417,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -28183,7 +28500,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -28323,17 +28640,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -28431,8 +28753,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -28603,24 +28925,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -28661,15 +28984,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -28716,8 +29040,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -29114,9 +29438,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -29178,7 +29502,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -29256,7 +29585,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -29396,17 +29725,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -29504,8 +29838,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -29676,24 +30010,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -29734,15 +30069,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -29789,8 +30125,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -30187,9 +30523,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -30251,7 +30587,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -30329,7 +30670,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -30469,17 +30810,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -30577,8 +30923,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -30749,24 +31095,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -30807,15 +31154,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -30862,8 +31210,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -31260,9 +31608,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -31324,7 +31672,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -31402,7 +31755,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -31542,17 +31895,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -31650,8 +32008,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -31822,24 +32180,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -31880,15 +32239,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -31935,8 +32295,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -32333,9 +32693,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -32397,7 +32757,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -32475,7 +32840,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -32615,17 +32980,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -32723,8 +33093,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -32895,24 +33265,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -32953,15 +33324,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -33008,8 +33380,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -33406,9 +33778,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -33470,7 +33842,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -33548,7 +33925,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -33688,17 +34065,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -33796,8 +34178,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -33968,24 +34350,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -34026,15 +34409,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -34081,8 +34465,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -34479,9 +34863,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -34543,7 +34927,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -34621,7 +35010,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -34761,17 +35150,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -34869,8 +35263,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -35041,24 +35435,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -35099,15 +35494,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -35154,8 +35550,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -35552,9 +35948,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -35616,7 +36012,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -35694,7 +36095,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -35834,17 +36235,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -35942,8 +36348,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -36114,24 +36520,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -36172,15 +36579,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -36227,8 +36635,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -36625,9 +37033,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -36689,7 +37097,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -36767,7 +37180,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -36907,17 +37320,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -37015,8 +37433,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -37187,24 +37605,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -37245,15 +37664,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -37300,8 +37720,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -37698,9 +38118,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -37762,7 +38182,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -37840,7 +38265,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -37980,17 +38405,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -38088,8 +38518,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -38260,24 +38690,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -38318,15 +38749,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -38373,8 +38805,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -38771,9 +39203,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -38835,7 +39267,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -38913,7 +39350,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -39053,17 +39490,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -39161,8 +39603,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -39333,24 +39775,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -39391,15 +39834,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -39446,8 +39890,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -39844,9 +40288,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -39908,7 +40352,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -39986,7 +40435,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -40126,17 +40575,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -40234,8 +40688,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -40406,24 +40860,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -40464,15 +40919,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -40519,8 +40975,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -40917,9 +41373,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -40981,7 +41437,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -41059,7 +41520,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -41199,17 +41660,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -41307,8 +41773,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -41479,24 +41945,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -41537,15 +42004,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -41592,8 +42060,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -41990,9 +42458,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -42054,7 +42522,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -42132,7 +42605,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -42272,17 +42745,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -42380,8 +42858,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -42552,24 +43030,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -42610,15 +43089,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -42665,8 +43145,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -43063,9 +43543,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -43127,7 +43607,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -43205,7 +43690,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -43345,17 +43830,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -43453,8 +43943,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -43625,24 +44115,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -43683,15 +44174,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -43738,8 +44230,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -44136,9 +44628,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -44200,7 +44692,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -44278,7 +44775,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -44418,17 +44915,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -44526,8 +45028,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -44698,24 +45200,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -44756,15 +45259,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -44811,8 +45315,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -45209,9 +45713,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -45273,7 +45777,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -45351,7 +45860,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -45491,17 +46000,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -45599,8 +46113,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -45771,24 +46285,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -45829,15 +46344,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -45884,8 +46400,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -46282,9 +46798,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -46346,7 +46862,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -46424,7 +46945,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -46564,17 +47085,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -46672,8 +47198,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -46844,24 +47370,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -46902,15 +47429,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -46957,8 +47485,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -47355,9 +47883,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -47419,7 +47947,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -47497,7 +48030,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -47637,17 +48170,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -47745,8 +48283,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -47917,24 +48455,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -47975,15 +48514,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -48030,8 +48570,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -48428,9 +48968,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -48492,7 +49032,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -48570,7 +49115,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -48710,17 +49255,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -48818,8 +49368,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -48990,24 +49540,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -49048,15 +49599,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -49103,8 +49655,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -49501,9 +50053,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -49565,7 +50117,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -49643,7 +50200,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -49783,17 +50340,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -49891,8 +50453,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -50063,24 +50625,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -50121,15 +50684,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -50176,8 +50740,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -50574,9 +51138,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -50638,7 +51202,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -50716,7 +51285,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -50856,17 +51425,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -50964,8 +51538,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -51136,24 +51710,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -51194,15 +51769,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -51249,8 +51825,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -51647,9 +52223,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -51711,7 +52287,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -51789,7 +52370,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -51929,17 +52510,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -52037,8 +52623,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -52209,24 +52795,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -52267,15 +52854,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -52322,8 +52910,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -52720,9 +53308,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -52784,7 +53372,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -52862,7 +53455,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -53002,17 +53595,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -53110,8 +53708,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -53282,24 +53880,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -53340,15 +53939,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -53395,8 +53995,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -53793,9 +54393,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -53857,7 +54457,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -53935,7 +54540,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -54075,17 +54680,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -54183,8 +54793,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -54355,24 +54965,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -54413,15 +55024,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -54468,8 +55080,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -54866,9 +55478,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -54930,7 +55542,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -55008,7 +55625,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -55148,17 +55765,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -55256,8 +55878,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -55428,24 +56050,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -55486,15 +56109,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -55541,8 +56165,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -55939,9 +56563,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -56003,7 +56627,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -56081,7 +56710,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -56221,17 +56850,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -56329,8 +56963,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -56501,24 +57135,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -56559,15 +57194,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -56614,8 +57250,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -57012,9 +57648,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -57076,7 +57712,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -57154,7 +57795,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -57294,17 +57935,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -57402,8 +58048,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -57574,24 +58220,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -57632,15 +58279,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -57687,8 +58335,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -58085,9 +58733,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -58149,7 +58797,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -58227,7 +58880,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -58367,17 +59020,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -58475,8 +59133,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -58647,24 +59305,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -58705,15 +59364,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -58760,8 +59420,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -59158,9 +59818,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -59222,7 +59882,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -59300,7 +59965,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -59440,17 +60105,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -59548,8 +60218,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -59720,24 +60390,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -59778,15 +60449,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -59833,8 +60505,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -60231,9 +60903,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -60295,7 +60967,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -60373,7 +61050,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -60513,17 +61190,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -60621,8 +61303,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -60793,24 +61475,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -60851,15 +61534,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -60906,8 +61590,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -61304,9 +61988,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -61368,7 +62052,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -61446,7 +62135,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -61586,17 +62275,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -61694,8 +62388,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -61866,24 +62560,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -61924,15 +62619,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -61979,8 +62675,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -62377,9 +63073,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -62441,7 +63137,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -62519,7 +63220,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -62659,17 +63360,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -62767,8 +63473,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -62939,24 +63645,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -62997,15 +63704,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -63052,8 +63760,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -63450,9 +64158,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -63514,7 +64222,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -63592,7 +64305,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -63732,17 +64445,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -63840,8 +64558,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -64012,24 +64730,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -64070,15 +64789,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -64125,8 +64845,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -64523,9 +65243,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -64587,7 +65307,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -64665,7 +65390,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -64805,17 +65530,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -64913,8 +65643,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -65085,24 +65815,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -65143,15 +65874,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -65198,8 +65930,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -65596,9 +66328,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -65660,7 +66392,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -65738,7 +66475,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -65878,17 +66615,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -65986,8 +66728,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -66158,24 +66900,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -66216,15 +66959,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -66271,8 +67015,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -66669,9 +67413,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -66733,7 +67477,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -66811,7 +67560,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -66951,17 +67700,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -67059,8 +67813,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -67231,24 +67985,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -67289,15 +68044,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -67344,8 +68100,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -67742,9 +68498,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -67806,7 +68562,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -67884,7 +68645,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -68024,17 +68785,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -68132,8 +68898,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -68304,24 +69070,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -68362,15 +69129,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -68417,8 +69185,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -68815,9 +69583,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -68879,7 +69647,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -68957,7 +69730,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -69097,17 +69870,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -69205,8 +69983,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -69377,24 +70155,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -69435,15 +70214,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -69490,8 +70270,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -69888,9 +70668,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -69952,7 +70732,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -70030,7 +70815,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -70170,17 +70955,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -70278,8 +71068,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -70450,24 +71240,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -70508,15 +71299,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -70563,8 +71355,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -70961,9 +71753,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -71025,7 +71817,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -71103,7 +71900,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -71243,17 +72040,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -71351,8 +72153,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -71523,24 +72325,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -71581,15 +72384,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -71636,8 +72440,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -72034,9 +72838,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -72098,7 +72902,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -72176,7 +72985,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -72316,17 +73125,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -72424,8 +73238,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -72596,24 +73410,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -72654,15 +73469,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -72709,8 +73525,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -73107,9 +73923,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -73171,7 +73987,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -73249,7 +74070,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -73389,17 +74210,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -73497,8 +74323,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -73669,24 +74495,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -73727,15 +74554,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -73782,8 +74610,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -74180,9 +75008,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -74244,7 +75072,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -74322,7 +75155,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -74462,17 +75295,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -74570,8 +75408,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -74742,24 +75580,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -74800,15 +75639,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -74855,8 +75695,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -75253,9 +76093,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -75317,7 +76157,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -75395,7 +76240,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -75535,17 +76380,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -75643,8 +76493,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -75815,24 +76665,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -75873,15 +76724,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -75928,8 +76780,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -76326,9 +77178,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -76390,7 +77242,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -76468,7 +77325,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -76608,17 +77465,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -76716,8 +77578,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -76888,24 +77750,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -76946,15 +77809,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -77001,8 +77865,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -77399,9 +78263,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -77463,7 +78327,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -77541,7 +78410,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -77681,17 +78550,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -77789,8 +78663,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -77961,24 +78835,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -78019,15 +78894,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -78074,8 +78950,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -78472,9 +79348,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -78536,7 +79412,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -78614,7 +79495,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -78754,17 +79635,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -78862,8 +79748,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -79034,24 +79920,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -79092,15 +79979,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -79147,8 +80035,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -79545,9 +80433,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -79609,7 +80497,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -79687,7 +80580,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -79827,17 +80720,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -79935,8 +80833,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -80107,24 +81005,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -80165,15 +81064,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -80220,8 +81120,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -80618,9 +81518,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -80682,7 +81582,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -80760,7 +81665,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -80900,17 +81805,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -81008,8 +81918,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -81180,24 +82090,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -81238,15 +82149,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -81293,8 +82205,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -81691,9 +82603,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -81755,7 +82667,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -81833,7 +82750,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -81973,17 +82890,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -82081,8 +83003,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -82253,24 +83175,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -82311,15 +83234,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -82366,8 +83290,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -82764,9 +83688,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -82828,7 +83752,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -82906,7 +83835,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -83046,17 +83975,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -83154,8 +84088,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -83326,24 +84260,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -83384,15 +84319,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -83439,8 +84375,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -83837,9 +84773,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -83901,7 +84837,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -83979,7 +84920,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -84119,17 +85060,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -84227,8 +85173,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -84399,24 +85345,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -84457,15 +85404,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -84512,8 +85460,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -84910,9 +85858,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -84974,7 +85922,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -85052,7 +86005,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -85192,17 +86145,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -85300,8 +86258,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -85472,24 +86430,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -85530,15 +86489,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -85585,8 +86545,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -85983,9 +86943,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -86047,7 +87007,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -86125,7 +87090,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -86265,17 +87230,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -86373,8 +87343,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -86545,24 +87515,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -86603,15 +87574,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -86658,8 +87630,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -87056,9 +88028,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -87120,7 +88092,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -87198,7 +88175,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -87338,17 +88315,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -87446,8 +88428,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -87618,24 +88600,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -87676,15 +88659,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -87731,8 +88715,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -88129,9 +89113,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -88193,7 +89177,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -88271,7 +89260,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -88411,17 +89400,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -88519,8 +89513,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -88691,24 +89685,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -88749,15 +89744,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -88804,8 +89800,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -89202,9 +90198,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -89266,7 +90262,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -89344,7 +90345,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -89484,17 +90485,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -89592,8 +90598,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -89764,24 +90770,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -89822,15 +90829,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -89877,8 +90885,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -90275,9 +91283,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -90339,7 +91347,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -90417,7 +91430,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -90557,17 +91570,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -90665,8 +91683,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -90837,24 +91855,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -90895,15 +91914,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -90950,8 +91970,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -91348,9 +92368,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -91412,7 +92432,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -91490,7 +92515,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -91630,17 +92655,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -91738,8 +92768,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -91910,24 +92940,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -91968,15 +92999,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -92023,8 +93055,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -92421,9 +93453,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -92485,7 +93517,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -92563,7 +93600,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -92703,17 +93740,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -92811,8 +93853,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -92983,24 +94025,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -93041,15 +94084,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -93096,8 +94140,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -93494,9 +94538,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -93558,7 +94602,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -93636,7 +94685,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -93776,17 +94825,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -93884,8 +94938,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -94056,24 +95110,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -94114,15 +95169,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -94169,8 +95225,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -94567,9 +95623,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -94631,7 +95687,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -94709,7 +95770,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -94849,17 +95910,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -94957,8 +96023,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -95129,24 +96195,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -95187,15 +96254,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -95242,8 +96310,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -95640,9 +96708,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -95704,7 +96772,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -95782,7 +96855,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -95922,17 +96995,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -96030,8 +97108,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -96202,24 +97280,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -96260,15 +97339,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -96315,8 +97395,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -96713,9 +97793,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -96777,7 +97857,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -96855,7 +97940,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -96995,17 +98080,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -97103,8 +98193,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -97275,24 +98365,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -97333,15 +98424,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -97388,8 +98480,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -97786,9 +98878,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -97850,7 +98942,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -97928,7 +99025,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -98068,17 +99165,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -98176,8 +99278,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -98348,24 +99450,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -98406,15 +99509,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -98461,8 +99565,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -98859,9 +99963,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -98923,7 +100027,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -99001,7 +100110,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -99141,17 +100250,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -99249,8 +100363,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -99421,24 +100535,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -99479,15 +100594,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -99534,8 +100650,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -99932,9 +101048,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -99996,7 +101112,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -100074,7 +101195,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -100214,17 +101335,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -100322,8 +101448,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -100494,24 +101620,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -100552,15 +101679,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -100607,8 +101735,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -101005,9 +102133,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -101069,7 +102197,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -101147,7 +102280,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -101287,17 +102420,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -101395,8 +102533,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -101567,24 +102705,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -101625,15 +102764,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -101680,8 +102820,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -102078,9 +103218,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -102142,7 +103282,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -102220,7 +103365,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -102360,17 +103505,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -102468,8 +103618,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -102640,24 +103790,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -102698,15 +103849,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -102753,8 +103905,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -103151,9 +104303,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -103215,7 +104367,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -103293,7 +104450,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -103433,17 +104590,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -103541,8 +104703,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -103713,24 +104875,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -103771,15 +104934,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -103826,8 +104990,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -104224,9 +105388,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -104288,7 +105452,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -104366,7 +105535,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -104506,17 +105675,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -104614,8 +105788,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -104786,24 +105960,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -104844,15 +106019,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -104899,8 +106075,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -105297,9 +106473,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -105361,7 +106537,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -105439,7 +106620,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -105579,17 +106760,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -105687,8 +106873,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -105859,24 +107045,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -105917,15 +107104,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -105972,8 +107160,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -106370,9 +107558,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -106434,7 +107622,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -106512,7 +107705,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -106652,17 +107845,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -106760,8 +107958,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -106932,24 +108130,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -106990,15 +108189,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -107045,8 +108245,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -107443,9 +108643,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -107507,7 +108707,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -107585,7 +108790,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -107725,17 +108930,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -107833,8 +109043,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -108005,24 +109215,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -108063,15 +109274,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -108118,8 +109330,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -108516,9 +109728,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -108580,7 +109792,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -108658,7 +109875,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -108798,17 +110015,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -108906,8 +110128,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -109078,24 +110300,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -109136,15 +110359,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -109191,8 +110415,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -109589,9 +110813,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -109653,7 +110877,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -109731,7 +110960,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -109871,17 +111100,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -109979,8 +111213,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -110151,24 +111385,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -110209,15 +111444,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -110264,8 +111500,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -110662,9 +111898,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -110726,7 +111962,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -110804,7 +112045,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -110944,17 +112185,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -111052,8 +112298,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -111224,24 +112470,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -111282,15 +112529,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -111337,8 +112585,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -111735,9 +112983,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -111799,7 +113047,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -111877,7 +113130,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -112017,17 +113270,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -112125,8 +113383,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -112297,24 +113555,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -112355,15 +113614,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -112410,8 +113670,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -112808,9 +114068,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -112872,7 +114132,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -112950,7 +114215,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -113090,17 +114355,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -113198,8 +114468,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -113370,24 +114640,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -113428,15 +114699,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -113483,8 +114755,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -113881,9 +115153,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -113945,7 +115217,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -114023,7 +115300,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -114163,17 +115440,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -114271,8 +115553,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -114443,24 +115725,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -114501,15 +115784,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -114556,8 +115840,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -114954,9 +116238,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -115018,7 +116302,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -115096,7 +116385,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -115236,17 +116525,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -115344,8 +116638,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -115516,24 +116810,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -115574,15 +116869,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -115629,8 +116925,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -116027,9 +117323,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -116091,7 +117387,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -116169,7 +117470,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -116309,17 +117610,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -116417,8 +117723,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -116589,24 +117895,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -116647,15 +117954,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -116702,8 +118010,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -117100,9 +118408,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -117164,7 +118472,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -117242,7 +118555,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -117382,17 +118695,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -117490,8 +118808,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -117662,24 +118980,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -117720,15 +119039,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -117775,8 +119095,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -118173,9 +119493,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -118237,7 +119557,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -118315,7 +119640,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -118455,17 +119780,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -118563,8 +119893,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -118735,24 +120065,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -118793,15 +120124,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -118848,8 +120180,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -119246,9 +120578,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -119310,7 +120642,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -119388,7 +120725,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -119528,17 +120865,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -119636,8 +120978,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -119808,24 +121150,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -119866,15 +121209,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -119921,8 +121265,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -120319,9 +121663,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -120383,7 +121727,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -120461,7 +121810,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -120601,17 +121950,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -120709,8 +122063,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -120881,24 +122235,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -120939,15 +122294,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -120994,8 +122350,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -121392,9 +122748,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -121456,7 +122812,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -121534,7 +122895,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -121674,17 +123035,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -121782,8 +123148,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -121954,24 +123320,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -122012,15 +123379,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -122067,8 +123435,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -122465,9 +123833,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -122529,7 +123897,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -122607,7 +123980,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -122747,17 +124120,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -122855,8 +124233,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -123027,24 +124405,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -123085,15 +124464,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -123140,8 +124520,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -123538,9 +124918,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -123602,7 +124982,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -123680,7 +125065,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -123820,17 +125205,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -123928,8 +125318,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -124100,24 +125490,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -124158,15 +125549,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -124213,8 +125605,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -124611,9 +126003,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -124675,7 +126067,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -124753,7 +126150,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -124893,17 +126290,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -125001,8 +126403,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -125173,24 +126575,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -125231,15 +126634,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -125286,8 +126690,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -125684,9 +127088,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -125748,7 +127152,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -125826,7 +127235,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -125966,17 +127375,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -126074,8 +127488,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -126246,24 +127660,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -126304,15 +127719,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -126359,8 +127775,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -126757,9 +128173,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -126821,7 +128237,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -126899,7 +128320,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -127039,17 +128460,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -127147,8 +128573,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -127319,24 +128745,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -127377,15 +128804,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -127432,8 +128860,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -127830,9 +129258,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -127894,7 +129322,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -127972,7 +129405,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -128112,17 +129545,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -128220,8 +129658,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -128392,24 +129830,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -128450,15 +129889,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -128505,8 +129945,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -128903,9 +130343,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -128967,7 +130407,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -129045,7 +130490,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -129185,17 +130630,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -129293,8 +130743,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -129465,24 +130915,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -129523,15 +130974,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -129578,8 +131030,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -129976,9 +131428,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -130040,7 +131492,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -130118,7 +131575,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -130258,17 +131715,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -130366,8 +131828,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -130538,24 +132000,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -130596,15 +132059,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -130651,8 +132115,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -131049,9 +132513,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -131113,7 +132577,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -131191,7 +132660,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -131331,17 +132800,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -131439,8 +132913,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -131611,24 +133085,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -131669,15 +133144,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -131724,8 +133200,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -132122,9 +133598,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -132186,7 +133662,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -132264,7 +133745,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -132404,17 +133885,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -132512,8 +133998,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -132684,24 +134170,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -132742,15 +134229,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -132797,8 +134285,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -133195,9 +134683,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -133259,7 +134747,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -133337,7 +134830,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -133477,17 +134970,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -133585,8 +135083,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -133757,24 +135255,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -133815,15 +135314,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -133870,8 +135370,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -134268,9 +135768,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -134332,7 +135832,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -134410,7 +135915,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -134550,17 +136055,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -134658,8 +136168,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -134830,24 +136340,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -134888,15 +136399,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -134943,8 +136455,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -135341,9 +136853,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -135405,7 +136917,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -135483,7 +137000,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -135623,17 +137140,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -135731,8 +137253,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -135903,24 +137425,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -135961,15 +137484,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -136016,8 +137540,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -136414,9 +137938,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -136478,7 +138002,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -136556,7 +138085,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -136696,17 +138225,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -136804,8 +138338,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -136976,24 +138510,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -137034,15 +138569,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -137089,8 +138625,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -137487,9 +139023,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -137551,7 +139087,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -137629,7 +139170,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -137769,17 +139310,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -137877,8 +139423,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -138049,24 +139595,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -138107,15 +139654,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -138162,8 +139710,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -138560,9 +140108,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -138624,7 +140172,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -138702,7 +140255,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -138842,17 +140395,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -138950,8 +140508,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -139122,24 +140680,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -139180,15 +140739,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -139235,8 +140795,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -139633,9 +141193,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -139697,7 +141257,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -139775,7 +141340,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -139915,17 +141480,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -140023,8 +141593,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -140195,24 +141765,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -140253,15 +141824,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -140308,8 +141880,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -140706,9 +142278,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -140770,7 +142342,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -140848,7 +142425,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -140988,17 +142565,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -141096,8 +142678,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -141268,24 +142850,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -141326,15 +142909,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -141381,8 +142965,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -141779,9 +143363,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -141843,7 +143427,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -141921,7 +143510,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -142061,17 +143650,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -142169,8 +143763,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -142341,24 +143935,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -142399,15 +143994,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -142454,8 +144050,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -142852,9 +144448,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -142916,7 +144512,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -142994,7 +144595,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -143134,17 +144735,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -143242,8 +144848,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -143414,24 +145020,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -143472,15 +145079,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -143527,8 +145135,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -143925,9 +145533,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -143989,7 +145597,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -144067,7 +145680,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -144207,17 +145820,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -144315,8 +145933,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -144487,24 +146105,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -144545,15 +146164,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -144600,8 +146220,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -144998,9 +146618,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -145062,7 +146682,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -145140,7 +146765,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -145280,17 +146905,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -145388,8 +147018,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -145560,24 +147190,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -145618,15 +147249,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -145673,8 +147305,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -146071,9 +147703,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -146135,7 +147767,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -146213,7 +147850,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -146353,17 +147990,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -146461,8 +148103,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -146633,24 +148275,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -146691,15 +148334,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -146746,8 +148390,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -147144,9 +148788,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -147208,7 +148852,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -147286,7 +148935,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -147426,17 +149075,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -147534,8 +149188,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -147706,24 +149360,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -147764,15 +149419,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -147819,8 +149475,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -148217,9 +149873,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -148281,7 +149937,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -148359,7 +150020,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -148499,17 +150160,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -148607,8 +150273,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -148779,24 +150445,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -148837,15 +150504,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -148892,8 +150560,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -149290,9 +150958,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -149354,7 +151022,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -149432,7 +151105,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -149572,17 +151245,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -149680,8 +151358,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -149852,24 +151530,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -149910,15 +151589,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -149965,8 +151645,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -150363,9 +152043,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -150427,7 +152107,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -150505,7 +152190,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -150645,17 +152330,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -150753,8 +152443,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -150925,24 +152615,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -150983,15 +152674,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -151038,8 +152730,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -151436,9 +153128,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -151500,7 +153192,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -151578,7 +153275,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -151718,17 +153415,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -151826,8 +153528,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -151998,24 +153700,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -152056,15 +153759,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -152111,8 +153815,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -152509,9 +154213,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -152573,7 +154277,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -152651,7 +154360,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -152791,17 +154500,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -152899,8 +154613,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -153071,24 +154785,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -153129,15 +154844,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -153184,8 +154900,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -153582,9 +155298,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -153646,7 +155362,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -153724,7 +155445,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -153864,17 +155585,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -153972,8 +155698,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -154144,24 +155870,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -154202,15 +155929,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -154257,8 +155985,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -154655,9 +156383,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -154719,7 +156447,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -154797,7 +156530,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -154937,17 +156670,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -155045,8 +156783,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -155217,24 +156955,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -155275,15 +157014,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -155330,8 +157070,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -155728,9 +157468,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -155792,7 +157532,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -155870,7 +157615,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -156010,17 +157755,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -156118,8 +157868,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -156290,24 +158040,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -156348,15 +158099,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -156403,8 +158155,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -156801,9 +158553,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -156865,7 +158617,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -156943,7 +158700,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -157083,17 +158840,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -157191,8 +158953,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -157363,24 +159125,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -157421,15 +159184,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -157476,8 +159240,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -157874,9 +159638,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -157938,7 +159702,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -158016,7 +159785,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -158156,17 +159925,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -158264,8 +160038,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -158436,24 +160210,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -158494,15 +160269,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -158549,8 +160325,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -158947,9 +160723,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -159011,7 +160787,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -159089,7 +160870,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -159229,17 +161010,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -159337,8 +161123,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -159509,24 +161295,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -159567,15 +161354,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -159622,8 +161410,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -160020,9 +161808,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -160084,7 +161872,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -160162,7 +161955,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -160302,17 +162095,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -160410,8 +162208,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -160582,24 +162380,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -160640,15 +162439,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -160695,8 +162495,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -161093,9 +162893,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -161157,7 +162957,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -161235,7 +163040,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -161375,17 +163180,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -161483,8 +163293,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -161655,24 +163465,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -161713,15 +163524,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -161768,8 +163580,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -162166,9 +163978,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -162230,7 +164042,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -162308,7 +164125,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -162448,17 +164265,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -162556,8 +164378,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -162728,24 +164550,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -162786,15 +164609,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -162841,8 +164665,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -163239,9 +165063,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -163303,7 +165127,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -163381,7 +165210,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -163521,17 +165350,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -163629,8 +165463,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -163801,24 +165635,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -163859,15 +165694,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -163914,8 +165750,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -164312,9 +166148,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -164376,7 +166212,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -164454,7 +166295,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -164594,17 +166435,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -164702,8 +166548,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -164874,24 +166720,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -164932,15 +166779,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -164987,8 +166835,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -165385,9 +167233,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -165449,7 +167297,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -165527,7 +167380,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -165667,17 +167520,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -165775,8 +167633,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -165947,24 +167805,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -166005,15 +167864,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -166060,8 +167920,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -166458,9 +168318,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -166522,7 +168382,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -166600,7 +168465,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -166740,17 +168605,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -166848,8 +168718,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -167020,24 +168890,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -167078,15 +168949,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -167133,8 +169005,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -167531,9 +169403,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -167595,7 +169467,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -167673,7 +169550,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -167813,17 +169690,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -167921,8 +169803,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -168093,24 +169975,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -168151,15 +170034,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -168206,8 +170090,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -168604,9 +170488,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -168668,7 +170552,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -168746,7 +170635,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -168886,17 +170775,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -168994,8 +170888,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -169166,24 +171060,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -169224,15 +171119,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -169279,8 +171175,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -169677,9 +171573,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -169741,7 +171637,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -169819,7 +171720,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -169959,17 +171860,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -170067,8 +171973,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -170239,24 +172145,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -170297,15 +172204,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -170352,8 +172260,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -170750,9 +172658,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -170814,7 +172722,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -170892,7 +172805,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -171032,17 +172945,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -171140,8 +173058,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -171312,24 +173230,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -171370,15 +173289,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -171425,8 +173345,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -171823,9 +173743,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -171887,7 +173807,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -171965,7 +173890,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -172105,17 +174030,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -172213,8 +174143,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -172385,24 +174315,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -172443,15 +174374,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -172498,8 +174430,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -172896,9 +174828,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -172960,7 +174892,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -173038,7 +174975,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -173178,17 +175115,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -173286,8 +175228,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -173458,24 +175400,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -173516,15 +175459,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -173571,8 +175515,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -173969,9 +175913,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -174033,7 +175977,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -174111,7 +176060,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -174251,17 +176200,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -174359,8 +176313,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -174531,24 +176485,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -174589,15 +176544,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -174644,8 +176600,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -175042,9 +176998,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -175106,7 +177062,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -175184,7 +177145,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -175324,17 +177285,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -175432,8 +177398,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -175604,24 +177570,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -175662,15 +177629,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -175717,8 +177685,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -176115,9 +178083,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -176179,7 +178147,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -176257,7 +178230,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -176397,17 +178370,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -176505,8 +178483,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -176677,24 +178655,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -176735,15 +178714,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -176790,8 +178770,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -177188,9 +179168,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -177252,7 +179232,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -177330,7 +179315,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -177470,17 +179455,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -177578,8 +179568,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -177750,24 +179740,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -177808,15 +179799,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -177863,8 +179855,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -178261,9 +180253,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -178325,7 +180317,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -178403,7 +180400,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -178543,17 +180540,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -178651,8 +180653,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -178823,24 +180825,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -178881,15 +180884,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -178936,8 +180940,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -179334,9 +181338,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -179398,7 +181402,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -179476,7 +181485,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -179616,17 +181625,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -179724,8 +181738,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -179896,24 +181910,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -179954,15 +181969,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -180009,8 +182025,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -180407,9 +182423,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -180471,7 +182487,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -180549,7 +182570,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -180689,17 +182710,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -180797,8 +182823,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -180969,24 +182995,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -181027,15 +183054,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -181082,8 +183110,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -181480,9 +183508,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -181544,7 +183572,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -181622,7 +183655,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -181762,17 +183795,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -181870,8 +183908,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -182042,24 +184080,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -182100,15 +184139,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -182155,8 +184195,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -182553,9 +184593,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -182617,7 +184657,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -182695,7 +184740,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -182835,17 +184880,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -182943,8 +184993,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -183115,24 +185165,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -183173,15 +185224,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -183228,8 +185280,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -183626,9 +185678,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -183690,7 +185742,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -183768,7 +185825,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -183908,17 +185965,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -184016,8 +186078,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -184188,24 +186250,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -184246,15 +186309,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -184301,8 +186365,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -184699,9 +186763,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -184763,7 +186827,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -184841,7 +186910,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -184981,17 +187050,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -185089,8 +187163,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -185261,24 +187335,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -185319,15 +187394,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -185374,8 +187450,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -185772,9 +187848,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -185836,7 +187912,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -185914,7 +187995,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -186054,17 +188135,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -186162,8 +188248,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -186334,24 +188420,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -186392,15 +188479,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -186447,8 +188535,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -186845,9 +188933,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -186909,7 +188997,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -186987,7 +189080,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -187127,17 +189220,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -187235,8 +189333,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -187407,24 +189505,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -187465,15 +189564,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -187520,8 +189620,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -187918,9 +190018,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -187982,7 +190082,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -188060,7 +190165,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -188200,17 +190305,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -188308,8 +190418,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -188480,24 +190590,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -188538,15 +190649,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -188593,8 +190705,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -188991,9 +191103,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -189055,7 +191167,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -189133,7 +191250,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -189273,17 +191390,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -189381,8 +191503,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -189553,24 +191675,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -189611,15 +191734,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -189666,8 +191790,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -190064,9 +192188,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -190128,7 +192252,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -190206,7 +192335,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -190346,17 +192475,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -190454,8 +192588,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -190626,24 +192760,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -190684,15 +192819,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -190739,8 +192875,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -191137,9 +193273,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -191201,7 +193337,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -191279,7 +193420,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -191419,17 +193560,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -191527,8 +193673,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -191699,24 +193845,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -191757,15 +193904,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -191812,8 +193960,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -192210,9 +194358,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -192274,7 +194422,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -192352,7 +194505,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -192492,17 +194645,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -192600,8 +194758,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -192772,24 +194930,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -192830,15 +194989,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -192885,8 +195045,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -193283,9 +195443,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -193347,7 +195507,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -193425,7 +195590,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -193565,17 +195730,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -193673,8 +195843,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -193845,24 +196015,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -193903,15 +196074,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -193958,8 +196130,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -194356,9 +196528,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -194420,7 +196592,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -194498,7 +196675,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -194638,17 +196815,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -194746,8 +196928,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -194918,24 +197100,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -194976,15 +197159,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -195031,8 +197215,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -195429,9 +197613,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -195493,7 +197677,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -195571,7 +197760,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -195711,17 +197900,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -195819,8 +198013,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -195991,24 +198185,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -196049,15 +198244,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -196104,8 +198300,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -196502,9 +198698,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -196566,7 +198762,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -196644,7 +198845,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -196784,17 +198985,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -196892,8 +199098,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -197064,24 +199270,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -197122,15 +199329,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -197177,8 +199385,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -197575,9 +199783,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -197639,7 +199847,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -197717,7 +199930,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -197857,17 +200070,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -197965,8 +200183,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -198137,24 +200355,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -198195,15 +200414,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -198250,8 +200470,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -198648,9 +200868,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -198712,7 +200932,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -198790,7 +201015,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -198930,17 +201155,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -199038,8 +201268,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -199210,24 +201440,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -199268,15 +201499,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -199323,8 +201555,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -199721,9 +201953,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -199785,7 +202017,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -199863,7 +202100,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -200003,17 +202240,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -200111,8 +202353,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -200283,24 +202525,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -200341,15 +202584,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -200396,8 +202640,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -200794,9 +203038,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -200858,7 +203102,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -200936,7 +203185,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -201076,17 +203325,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -201184,8 +203438,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -201356,24 +203610,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -201414,15 +203669,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -201469,8 +203725,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -201867,9 +204123,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -201931,7 +204187,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -202009,7 +204270,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -202149,17 +204410,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -202257,8 +204523,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -202429,24 +204695,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -202487,15 +204754,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -202542,8 +204810,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -202940,9 +205208,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -203004,7 +205272,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -203082,7 +205355,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -203222,17 +205495,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -203330,8 +205608,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -203502,24 +205780,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -203560,15 +205839,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -203615,8 +205895,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -204013,9 +206293,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -204077,7 +206357,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -204155,7 +206440,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -204295,17 +206580,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -204403,8 +206693,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -204575,24 +206865,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -204633,15 +206924,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -204688,8 +206980,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -205086,9 +207378,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -205150,7 +207442,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -205228,7 +207525,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -205368,17 +207665,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -205476,8 +207778,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -205648,24 +207950,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -205706,15 +208009,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -205761,8 +208065,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -206159,9 +208463,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -206223,7 +208527,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -206301,7 +208610,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -206441,17 +208750,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -206549,8 +208863,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -206721,24 +209035,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -206779,15 +209094,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -206834,8 +209150,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -207232,9 +209548,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -207296,7 +209612,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -207374,7 +209695,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -207514,17 +209835,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -207622,8 +209948,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -207794,24 +210120,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -207852,15 +210179,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -207907,8 +210235,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -208305,9 +210633,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -208369,7 +210697,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -208447,7 +210780,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -208587,17 +210920,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -208695,8 +211033,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -208867,24 +211205,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -208925,15 +211264,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -208980,8 +211320,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -209378,9 +211718,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -209442,7 +211782,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -209520,7 +211865,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -209660,17 +212005,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -209768,8 +212118,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -209940,24 +212290,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -209998,15 +212349,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -210053,8 +212405,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -210451,9 +212803,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -210515,7 +212867,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -210593,7 +212950,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -210733,17 +213090,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -210841,8 +213203,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -211013,24 +213375,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -211071,15 +213434,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -211126,8 +213490,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -211524,9 +213888,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -211588,7 +213952,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -211666,7 +214035,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -211806,17 +214175,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -211914,8 +214288,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -212086,24 +214460,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -212144,15 +214519,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -212199,8 +214575,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -212597,9 +214973,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -212661,7 +215037,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -212739,7 +215120,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -212879,17 +215260,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -212987,8 +215373,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -213159,24 +215545,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -213217,15 +215604,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -213272,8 +215660,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -213670,9 +216058,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -213734,7 +216122,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -213812,7 +216205,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -213952,17 +216345,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -214060,8 +216458,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -214232,24 +216630,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -214290,15 +216689,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -214345,8 +216745,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -214743,9 +217143,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -214807,7 +217207,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -214885,7 +217290,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -215025,17 +217430,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -215133,8 +217543,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -215305,24 +217715,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -215363,15 +217774,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -215418,8 +217830,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -215816,9 +218228,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -215880,7 +218292,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -215958,7 +218375,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -216098,17 +218515,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -216206,8 +218628,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -216378,24 +218800,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -216436,15 +218859,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -216491,8 +218915,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -216889,9 +219313,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -216953,7 +219377,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -217031,7 +219460,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -217171,17 +219600,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -217279,8 +219713,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -217451,24 +219885,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -217509,15 +219944,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -217564,8 +220000,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -217962,9 +220398,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -218026,7 +220462,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -218104,7 +220545,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -218244,17 +220685,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -218352,8 +220798,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -218524,24 +220970,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -218582,15 +221029,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -218637,8 +221085,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -219035,9 +221483,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -219099,7 +221547,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -219177,7 +221630,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -219317,17 +221770,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -219425,8 +221883,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -219597,24 +222055,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -219655,15 +222114,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -219710,8 +222170,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -220108,9 +222568,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -220172,7 +222632,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -220250,7 +222715,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -220390,17 +222855,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -220498,8 +222968,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -220670,24 +223140,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -220728,15 +223199,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -220783,8 +223255,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -221181,9 +223653,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -221245,7 +223717,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -221323,7 +223800,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -221463,17 +223940,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -221571,8 +224053,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -221743,24 +224225,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -221801,15 +224284,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -221856,8 +224340,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -222254,9 +224738,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -222318,7 +224802,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -222396,7 +224885,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -222536,17 +225025,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -222644,8 +225138,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -222816,24 +225310,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -222874,15 +225369,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -222929,8 +225425,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -223327,9 +225823,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -223391,7 +225887,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -223469,7 +225970,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -223609,17 +226110,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -223717,8 +226223,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -223889,24 +226395,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -223947,15 +226454,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -224002,8 +226510,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -224400,9 +226908,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -224464,7 +226972,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -224542,7 +227055,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -224682,17 +227195,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -224790,8 +227308,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -224962,24 +227480,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -225020,15 +227539,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -225075,8 +227595,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -225473,9 +227993,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -225537,7 +228057,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -225615,7 +228140,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -225755,17 +228280,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -225863,8 +228393,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -226035,24 +228565,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -226093,15 +228624,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -226148,8 +228680,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -226546,9 +229078,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -226610,7 +229142,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -226688,7 +229225,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -226828,17 +229365,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -226936,8 +229478,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -227108,24 +229650,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -227166,15 +229709,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -227221,8 +229765,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -227619,9 +230163,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -227683,7 +230227,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -227761,7 +230310,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -227901,17 +230450,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -228009,8 +230563,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -228181,24 +230735,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -228239,15 +230794,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -228294,8 +230850,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -228692,9 +231248,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -228756,7 +231312,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -228834,7 +231395,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -228974,17 +231535,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -229082,8 +231648,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -229254,24 +231820,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -229312,15 +231879,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -229367,8 +231935,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -229765,9 +232333,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -229829,7 +232397,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -229907,7 +232480,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -230047,17 +232620,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -230155,8 +232733,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -230327,24 +232905,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -230385,15 +232964,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -230440,8 +233020,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -230838,9 +233418,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -230902,7 +233482,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -230980,7 +233565,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -231120,17 +233705,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -231228,8 +233818,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -231400,24 +233990,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -231458,15 +234049,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -231513,8 +234105,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -231911,9 +234503,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -231975,7 +234567,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -232053,7 +234650,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -232193,17 +234790,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -232301,8 +234903,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -232473,24 +235075,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -232531,15 +235134,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -232586,8 +235190,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -232984,9 +235588,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -233048,7 +235652,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -233126,7 +235735,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -233266,17 +235875,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -233374,8 +235988,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -233546,24 +236160,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -233604,15 +236219,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -233659,8 +236275,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -234057,9 +236673,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -234121,7 +236737,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -234199,7 +236820,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -234339,17 +236960,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -234447,8 +237073,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -234619,24 +237245,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -234677,15 +237304,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -234732,8 +237360,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -235130,9 +237758,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -235194,7 +237822,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -235272,7 +237905,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -235412,17 +238045,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -235520,8 +238158,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -235692,24 +238330,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -235750,15 +238389,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -235805,8 +238445,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -236203,9 +238843,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -236267,7 +238907,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -236345,7 +238990,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -236485,17 +239130,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -236593,8 +239243,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -236765,24 +239415,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -236823,15 +239474,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -236878,8 +239530,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -237276,9 +239928,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -237340,7 +239992,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -237418,7 +240075,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -237558,17 +240215,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -237666,8 +240328,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -237838,24 +240500,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -237896,15 +240559,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -237951,8 +240615,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -238349,9 +241013,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -238413,7 +241077,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -238491,7 +241160,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -238631,17 +241300,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -238739,8 +241413,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -238911,24 +241585,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -238969,15 +241644,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -239024,8 +241700,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -239422,9 +242098,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -239486,7 +242162,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -239564,7 +242245,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -239704,17 +242385,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -239812,8 +242498,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -239984,24 +242670,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -240042,15 +242729,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -240097,8 +242785,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -240495,9 +243183,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -240559,7 +243247,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -240637,7 +243330,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -240777,17 +243470,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -240885,8 +243583,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -241057,24 +243755,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -241115,15 +243814,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -241170,8 +243870,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -241568,9 +244268,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -241632,7 +244332,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -241710,7 +244415,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -241850,17 +244555,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -241958,8 +244668,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -242130,24 +244840,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -242188,15 +244899,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -242243,8 +244955,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -242641,9 +245353,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -242705,7 +245417,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -242783,7 +245500,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -242923,17 +245640,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -243031,8 +245753,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -243203,24 +245925,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -243261,15 +245984,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -243316,8 +246040,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -243714,9 +246438,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -243778,7 +246502,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -243856,7 +246585,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -243996,17 +246725,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -244104,8 +246838,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -244276,24 +247010,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -244334,15 +247069,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -244389,8 +247125,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -244787,9 +247523,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -244851,7 +247587,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -244929,7 +247670,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -245069,17 +247810,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -245177,8 +247923,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -245349,24 +248095,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -245407,15 +248154,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -245462,8 +248210,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -245860,9 +248608,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -245924,7 +248672,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -246002,7 +248755,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -246142,17 +248895,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -246250,8 +249008,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -246422,24 +249180,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -246480,15 +249239,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -246535,8 +249295,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -246933,9 +249693,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -246997,7 +249757,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -247075,7 +249840,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -247215,17 +249980,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -247323,8 +250093,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -247495,24 +250265,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -247553,15 +250324,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -247608,8 +250380,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -248006,9 +250778,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -248070,7 +250842,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -248148,7 +250925,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -248288,17 +251065,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -248396,8 +251178,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -248568,24 +251350,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -248626,15 +251409,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -248681,8 +251465,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -249079,9 +251863,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -249143,7 +251927,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -249221,7 +252010,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -249361,17 +252150,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -249469,8 +252263,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -249641,24 +252435,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -249699,15 +252494,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -249754,8 +252550,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -250152,9 +252948,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -250216,7 +253012,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -250294,7 +253095,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -250434,17 +253235,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -250542,8 +253348,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -250714,24 +253520,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -250772,15 +253579,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -250827,8 +253635,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -251225,9 +254033,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -251289,7 +254097,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -251367,7 +254180,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -251507,17 +254320,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -251615,8 +254433,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -251787,24 +254605,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -251845,15 +254664,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -251900,8 +254720,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -252298,9 +255118,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -252362,7 +255182,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -252440,7 +255265,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -252580,17 +255405,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -252688,8 +255518,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -252860,24 +255690,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -252918,15 +255749,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -252973,8 +255805,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -253371,9 +256203,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -253435,7 +256267,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -253513,7 +256350,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -253653,17 +256490,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -253761,8 +256603,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -253933,24 +256775,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -253991,15 +256834,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -254046,8 +256890,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -254444,9 +257288,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -254508,7 +257352,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -254586,7 +257435,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -254726,17 +257575,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -254834,8 +257688,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -255006,24 +257860,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -255064,15 +257919,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -255119,8 +257975,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -255517,9 +258373,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -255581,7 +258437,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -255659,7 +258520,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -255799,17 +258660,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -255907,8 +258773,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -256079,24 +258945,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -256137,15 +259004,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -256192,8 +259060,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -256590,9 +259458,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -256654,7 +259522,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -256732,7 +259605,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -256872,17 +259745,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -256980,8 +259858,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -257152,24 +260030,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -257210,15 +260089,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -257265,8 +260145,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -257663,9 +260543,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -257727,7 +260607,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -257805,7 +260690,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -257945,17 +260830,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -258053,8 +260943,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -258225,24 +261115,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -258283,15 +261174,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -258338,8 +261230,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -258736,9 +261628,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -258800,7 +261692,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -258878,7 +261775,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -259018,17 +261915,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -259126,8 +262028,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -259298,24 +262200,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -259356,15 +262259,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -259411,8 +262315,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -259809,9 +262713,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -259873,7 +262777,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -259951,7 +262860,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -260091,17 +263000,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -260199,8 +263113,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -260371,24 +263285,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -260429,15 +263344,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -260484,8 +263400,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -260882,9 +263798,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -260946,7 +263862,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -261024,7 +263945,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -261164,17 +264085,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -261272,8 +264198,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -261444,24 +264370,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -261502,15 +264429,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -261557,8 +264485,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -261955,9 +264883,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -262019,7 +264947,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -262097,7 +265030,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -262237,17 +265170,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -262345,8 +265283,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -262517,24 +265455,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -262575,15 +265514,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -262630,8 +265570,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -263028,9 +265968,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -263092,7 +266032,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -263170,7 +266115,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -263310,17 +266255,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -263418,8 +266368,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -263590,24 +266540,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -263648,15 +266599,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -263703,8 +266655,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -264101,9 +267053,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -264165,7 +267117,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -264243,7 +267200,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -264383,17 +267340,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -264491,8 +267453,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -264663,24 +267625,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -264721,15 +267684,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -264776,8 +267740,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -265174,9 +268138,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -265238,7 +268202,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -265316,7 +268285,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -265456,17 +268425,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -265564,8 +268538,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -265736,24 +268710,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -265794,15 +268769,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -265849,8 +268825,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -266247,9 +269223,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -266311,7 +269287,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -266389,7 +269370,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -266529,17 +269510,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -266637,8 +269623,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -266809,24 +269795,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -266867,15 +269854,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -266922,8 +269910,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -267320,9 +270308,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -267384,7 +270372,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -267462,7 +270455,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -267602,17 +270595,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -267710,8 +270708,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -267882,24 +270880,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -267940,15 +270939,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -267995,8 +270995,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -268393,9 +271393,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -268457,7 +271457,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -268535,7 +271540,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -268675,17 +271680,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -268783,8 +271793,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -268955,24 +271965,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -269013,15 +272024,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -269068,8 +272080,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -269466,9 +272478,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -269530,7 +272542,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -269608,7 +272625,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -269748,17 +272765,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -269856,8 +272878,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -270028,24 +273050,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -270086,15 +273109,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -270141,8 +273165,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -270539,9 +273563,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -270603,7 +273627,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -270681,7 +273710,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -270821,17 +273850,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -270929,8 +273963,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -271101,24 +274135,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -271159,15 +274194,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -271214,8 +274250,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -271612,9 +274648,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -271676,7 +274712,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -271754,7 +274795,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -271894,17 +274935,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -272002,8 +275048,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -272174,24 +275220,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -272232,15 +275279,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -272287,8 +275335,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -272685,9 +275733,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -272749,7 +275797,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -272827,7 +275880,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -272967,17 +276020,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -273075,8 +276133,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -273247,24 +276305,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -273305,15 +276364,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -273360,8 +276420,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -273758,9 +276818,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -273822,7 +276882,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -273900,7 +276965,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -274040,17 +277105,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -274148,8 +277218,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -274320,24 +277390,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -274378,15 +277449,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -274433,8 +277505,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -274831,9 +277903,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -274895,7 +277967,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -274973,7 +278050,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -275113,17 +278190,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -275221,8 +278303,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -275393,24 +278475,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -275451,15 +278534,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -275506,8 +278590,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -275904,9 +278988,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -275968,7 +279052,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -276046,7 +279135,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -276186,17 +279275,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -276294,8 +279388,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -276466,24 +279560,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -276524,15 +279619,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -276579,8 +279675,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -276977,9 +280073,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -277041,7 +280137,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -277119,7 +280220,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -277259,17 +280360,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -277367,8 +280473,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -277539,24 +280645,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -277597,15 +280704,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -277652,8 +280760,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -278050,9 +281158,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -278114,7 +281222,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -278192,7 +281305,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -278332,17 +281445,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -278440,8 +281558,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -278612,24 +281730,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -278670,15 +281789,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -278725,8 +281845,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -279123,9 +282243,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -279187,7 +282307,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -279265,7 +282390,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -279405,17 +282530,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -279513,8 +282643,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -279685,24 +282815,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -279743,15 +282874,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -279798,8 +282930,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -280196,9 +283328,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -280260,7 +283392,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -280338,7 +283475,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -280478,17 +283615,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -280586,8 +283728,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -280758,24 +283900,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -280816,15 +283959,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -280871,8 +284015,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -281269,9 +284413,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -281333,7 +284477,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -281411,7 +284560,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -281551,17 +284700,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -281659,8 +284813,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -281831,24 +284985,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -281889,15 +285044,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -281944,8 +285100,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -282342,9 +285498,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -282406,7 +285562,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -282484,7 +285645,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -282624,17 +285785,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -282732,8 +285898,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -282904,24 +286070,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -282962,15 +286129,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -283017,8 +286185,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -283415,9 +286583,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -283479,7 +286647,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -283557,7 +286730,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -283697,17 +286870,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -283805,8 +286983,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -283977,24 +287155,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -284035,15 +287214,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -284090,8 +287270,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -284488,9 +287668,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -284552,7 +287732,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -284630,7 +287815,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -284770,17 +287955,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -284878,8 +288068,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -285050,24 +288240,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -285108,15 +288299,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -285163,8 +288355,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -285561,9 +288753,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -285625,7 +288817,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -285703,7 +288900,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -285843,17 +289040,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -285951,8 +289153,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -286123,24 +289325,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -286181,15 +289384,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -286236,8 +289440,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -286634,9 +289838,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -286698,7 +289902,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -286776,7 +289985,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -286916,17 +290125,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -287024,8 +290238,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -287196,24 +290410,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -287254,15 +290469,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -287309,8 +290525,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -287707,9 +290923,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -287771,7 +290987,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -287849,7 +291070,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -287989,17 +291210,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -288097,8 +291323,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -288269,24 +291495,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -288327,15 +291554,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -288382,8 +291610,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -288780,9 +292008,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -288844,7 +292072,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -288922,7 +292155,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -289062,17 +292295,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -289170,8 +292408,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -289342,24 +292580,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -289400,15 +292639,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -289455,8 +292695,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -289853,9 +293093,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -289917,7 +293157,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -289995,7 +293240,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -290135,17 +293380,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -290243,8 +293493,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -290415,24 +293665,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -290473,15 +293724,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -290528,8 +293780,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -290926,9 +294178,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -290990,7 +294242,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -291068,7 +294325,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -291208,17 +294465,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -291316,8 +294578,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -291488,24 +294750,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -291546,15 +294809,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -291601,8 +294865,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -291999,9 +295263,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -292063,7 +295327,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -292141,7 +295410,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -292281,17 +295550,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -292389,8 +295663,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -292561,24 +295835,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -292619,15 +295894,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -292674,8 +295950,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -293072,9 +296348,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -293136,7 +296412,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -293214,7 +296495,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -293354,17 +296635,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -293462,8 +296748,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -293634,24 +296920,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -293692,15 +296979,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -293747,8 +297035,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -294145,9 +297433,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -294209,7 +297497,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -294287,7 +297580,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -294427,17 +297720,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -294535,8 +297833,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -294707,24 +298005,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -294765,15 +298064,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -294820,8 +298120,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -295218,9 +298518,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -295282,7 +298582,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -295360,7 +298665,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -295500,17 +298805,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -295608,8 +298918,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -295780,24 +299090,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -295838,15 +299149,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -295893,8 +299205,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -296291,9 +299603,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -296355,7 +299667,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -296433,7 +299750,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -296573,17 +299890,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -296681,8 +300003,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -296853,24 +300175,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -296911,15 +300234,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -296966,8 +300290,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -297364,9 +300688,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -297428,7 +300752,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -297506,7 +300835,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -297646,17 +300975,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -297754,8 +301088,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -297926,24 +301260,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -297984,15 +301319,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -298039,8 +301375,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -298437,9 +301773,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -298501,7 +301837,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -298579,7 +301920,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -298719,17 +302060,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -298827,8 +302173,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -298999,24 +302345,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -299057,15 +302404,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -299112,8 +302460,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -299510,9 +302858,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -299574,7 +302922,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -299652,7 +303005,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -299792,17 +303145,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -299900,8 +303258,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -300072,24 +303430,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -300130,15 +303489,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -300185,8 +303545,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -300583,9 +303943,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -300647,7 +304007,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -300725,7 +304090,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -300865,17 +304230,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -300973,8 +304343,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -301145,24 +304515,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -301203,15 +304574,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -301258,8 +304630,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -301656,9 +305028,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -301720,7 +305092,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -301798,7 +305175,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -301938,17 +305315,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -302046,8 +305428,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -302218,24 +305600,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -302276,15 +305659,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -302331,8 +305715,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -302729,9 +306113,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -302793,7 +306177,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -302871,7 +306260,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -303011,17 +306400,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -303119,8 +306513,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -303291,24 +306685,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -303349,15 +306744,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -303404,8 +306800,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -303802,9 +307198,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -303866,7 +307262,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -303944,7 +307345,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -304084,17 +307485,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -304192,8 +307598,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -304364,24 +307770,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -304422,15 +307829,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -304477,8 +307885,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -304875,9 +308283,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -304939,7 +308347,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -305017,7 +308430,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -305157,17 +308570,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -305265,8 +308683,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -305437,24 +308855,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -305495,15 +308914,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -305550,8 +308970,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -305948,9 +309368,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -306012,7 +309432,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -306090,7 +309515,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -306230,17 +309655,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -306338,8 +309768,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -306510,24 +309940,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -306568,15 +309999,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -306623,8 +310055,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -307021,9 +310453,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -307085,7 +310517,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -307163,7 +310600,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -307303,17 +310740,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -307411,8 +310853,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -307583,24 +311025,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -307641,15 +311084,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -307696,8 +311140,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -308094,9 +311538,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -308158,7 +311602,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -308236,7 +311685,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -308376,17 +311825,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -308484,8 +311938,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -308656,24 +312110,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -308714,15 +312169,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -308769,8 +312225,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -309167,9 +312623,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -309231,7 +312687,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -309309,7 +312770,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -309449,17 +312910,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -309557,8 +313023,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -309729,24 +313195,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -309787,15 +313254,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -309842,8 +313310,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -310240,9 +313708,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -310304,7 +313772,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -310382,7 +313855,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -310522,17 +313995,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -310630,8 +314108,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -310802,24 +314280,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -310860,15 +314339,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -310915,8 +314395,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -311313,9 +314793,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -311377,7 +314857,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -311455,7 +314940,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -311595,17 +315080,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -311703,8 +315193,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -311875,24 +315365,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -311933,15 +315424,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -311988,8 +315480,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -312386,9 +315878,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -312450,7 +315942,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -312528,7 +316025,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -312668,17 +316165,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -312776,8 +316278,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -312948,24 +316450,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -313006,15 +316509,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -313061,8 +316565,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -313459,9 +316963,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -313523,7 +317027,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -313601,7 +317110,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -313741,17 +317250,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -313849,8 +317363,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -314021,24 +317535,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -314079,15 +317594,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -314134,8 +317650,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -314532,9 +318048,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -314596,7 +318112,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -314674,7 +318195,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -314814,17 +318335,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -314922,8 +318448,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -315094,24 +318620,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -315152,15 +318679,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -315207,8 +318735,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -315605,9 +319133,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -315669,7 +319197,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -315747,7 +319280,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -315887,17 +319420,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -315995,8 +319533,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -316167,24 +319705,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -316225,15 +319764,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -316280,8 +319820,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -316678,9 +320218,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -316742,7 +320282,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -316820,7 +320365,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -316960,17 +320505,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -317068,8 +320618,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -317240,24 +320790,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -317298,15 +320849,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -317353,8 +320905,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -317751,9 +321303,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -317815,7 +321367,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -317893,7 +321450,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -318033,17 +321590,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -318141,8 +321703,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -318313,24 +321875,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -318371,15 +321934,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -318426,8 +321990,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -318824,9 +322388,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -318888,7 +322452,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -318966,7 +322535,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -319106,17 +322675,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -319214,8 +322788,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -319386,24 +322960,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -319444,15 +323019,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -319499,8 +323075,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -319897,9 +323473,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -319961,7 +323537,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -320039,7 +323620,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -320179,17 +323760,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -320287,8 +323873,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -320459,24 +324045,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -320517,15 +324104,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -320572,8 +324160,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -320970,9 +324558,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -321034,7 +324622,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -321112,7 +324705,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -321252,17 +324845,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -321360,8 +324958,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -321532,24 +325130,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -321590,15 +325189,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -321645,8 +325245,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -322043,9 +325643,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -322107,7 +325707,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -322185,7 +325790,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -322325,17 +325930,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -322433,8 +326043,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -322605,24 +326215,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -322663,15 +326274,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -322718,8 +326330,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -323116,9 +326728,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -323180,7 +326792,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -323258,7 +326875,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -323398,17 +327015,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -323506,8 +327128,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -323678,24 +327300,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -323736,15 +327359,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -323791,8 +327415,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -324189,9 +327813,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -324253,7 +327877,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -324331,7 +327960,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -324471,17 +328100,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -324579,8 +328213,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -324751,24 +328385,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -324809,15 +328444,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -324864,8 +328500,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -325262,9 +328898,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -325326,7 +328962,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -325404,7 +329045,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -325544,17 +329185,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -325652,8 +329298,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -325824,24 +329470,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -325882,15 +329529,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -325937,8 +329585,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -326335,9 +329983,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -326399,7 +330047,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -326477,7 +330130,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -326617,17 +330270,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -326725,8 +330383,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -326897,24 +330555,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -326955,15 +330614,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -327010,8 +330670,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -327408,9 +331068,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -327472,7 +331132,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -327550,7 +331215,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -327690,17 +331355,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -327798,8 +331468,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -327970,24 +331640,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -328028,15 +331699,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -328083,8 +331755,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -328481,9 +332153,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -328545,7 +332217,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -328623,7 +332300,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -328763,17 +332440,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -328871,8 +332553,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -329043,24 +332725,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -329101,15 +332784,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -329156,8 +332840,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -329554,9 +333238,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -329618,7 +333302,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -329696,7 +333385,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -329836,17 +333525,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -329944,8 +333638,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -330116,24 +333810,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -330174,15 +333869,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -330229,8 +333925,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -330627,9 +334323,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -330691,7 +334387,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -330769,7 +334470,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -330909,17 +334610,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -331017,8 +334723,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -331189,24 +334895,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -331247,15 +334954,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -331302,8 +335010,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -331700,9 +335408,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -331764,7 +335472,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -331842,7 +335555,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -331982,17 +335695,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -332090,8 +335808,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -332262,24 +335980,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -332320,15 +336039,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -332375,8 +336095,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -332773,9 +336493,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -332837,7 +336557,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -332915,7 +336640,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -333055,17 +336780,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -333163,8 +336893,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -333335,24 +337065,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -333393,15 +337124,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -333448,8 +337180,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -333846,9 +337578,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -333910,7 +337642,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -333988,7 +337725,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -334128,17 +337865,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -334236,8 +337978,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -334408,24 +338150,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -334466,15 +338209,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -334521,8 +338265,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -334919,9 +338663,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -334983,7 +338727,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -335061,7 +338810,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -335201,17 +338950,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -335309,8 +339063,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -335481,24 +339235,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -335539,15 +339294,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -335594,8 +339350,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -335992,9 +339748,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -336056,7 +339812,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -336134,7 +339895,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -336274,17 +340035,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -336382,8 +340148,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -336554,24 +340320,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -336612,15 +340379,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -336667,8 +340435,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -337065,9 +340833,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -337129,7 +340897,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -337207,7 +340980,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -337347,17 +341120,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -337455,8 +341233,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -337627,24 +341405,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -337685,15 +341464,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -337740,8 +341520,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -338138,9 +341918,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -338202,7 +341982,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -338280,7 +342065,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -338420,17 +342205,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -338528,8 +342318,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -338700,24 +342490,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -338758,15 +342549,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -338813,8 +342605,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -339211,9 +343003,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -339275,7 +343067,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -339353,7 +343150,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -339493,17 +343290,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -339601,8 +343403,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -339773,24 +343575,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -339831,15 +343634,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -339886,8 +343690,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -340284,9 +344088,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -340348,7 +344152,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -340426,7 +344235,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -340566,17 +344375,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -340674,8 +344488,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -340846,24 +344660,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -340904,15 +344719,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -340959,8 +344775,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -341357,9 +345173,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -341421,7 +345237,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -341499,7 +345320,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -341639,17 +345460,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -341747,8 +345573,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -341919,24 +345745,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -341977,15 +345804,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -342032,8 +345860,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -342430,9 +346258,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -342494,7 +346322,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -342572,7 +346405,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -342712,17 +346545,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -342820,8 +346658,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -342992,24 +346830,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -343050,15 +346889,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -343105,8 +346945,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -343503,9 +347343,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -343567,7 +347407,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -343645,7 +347490,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -343785,17 +347630,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -343893,8 +347743,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -344065,24 +347915,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -344123,15 +347974,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -344178,8 +348030,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -344576,9 +348428,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -344640,7 +348492,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -344718,7 +348575,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -344858,17 +348715,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -344966,8 +348828,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -345138,24 +349000,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -345196,15 +349059,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -345251,8 +349115,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -345649,9 +349513,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -345713,7 +349577,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -345791,7 +349660,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -345931,17 +349800,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -346039,8 +349913,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -346211,24 +350085,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -346269,15 +350144,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -346324,8 +350200,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -346722,9 +350598,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -346786,7 +350662,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -346864,7 +350745,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -347004,17 +350885,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -347112,8 +350998,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -347284,24 +351170,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -347342,15 +351229,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -347397,8 +351285,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -347795,9 +351683,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -347859,7 +351747,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -347937,7 +351830,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -348077,17 +351970,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -348185,8 +352083,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -348357,24 +352255,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -348415,15 +352314,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -348470,8 +352370,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -348868,9 +352768,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -348932,7 +352832,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -349010,7 +352915,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -349150,17 +353055,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -349258,8 +353168,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -349430,24 +353340,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -349488,15 +353399,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -349543,8 +353455,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -349941,9 +353853,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -350005,7 +353917,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -350083,7 +354000,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -350223,17 +354140,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -350331,8 +354253,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -350503,24 +354425,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -350561,15 +354484,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -350616,8 +354540,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -351014,9 +354938,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -351078,7 +355002,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -351156,7 +355085,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -351296,17 +355225,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -351404,8 +355338,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -351576,24 +355510,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -351634,15 +355569,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -351689,8 +355625,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -352087,9 +356023,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -352151,7 +356087,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -352229,7 +356170,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -352369,17 +356310,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -352477,8 +356423,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -352649,24 +356595,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -352707,15 +356654,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -352762,8 +356710,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -353160,9 +357108,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -353224,7 +357172,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -353302,7 +357255,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -353442,17 +357395,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -353550,8 +357508,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -353722,24 +357680,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -353780,15 +357739,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -353835,8 +357795,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -354233,9 +358193,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -354297,7 +358257,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -354375,7 +358340,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -354515,17 +358480,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -354623,8 +358593,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -354795,24 +358765,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -354853,15 +358824,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -354908,8 +358880,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -355306,9 +359278,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -355370,7 +359342,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -355448,7 +359425,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -355588,17 +359565,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -355696,8 +359678,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -355868,24 +359850,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -355926,15 +359909,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -355981,8 +359965,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -356379,9 +360363,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -356443,7 +360427,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -356521,7 +360510,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -356661,17 +360650,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -356769,8 +360763,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -356941,24 +360935,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -356999,15 +360994,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -357054,8 +361050,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -357452,9 +361448,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -357516,7 +361512,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -357594,7 +361595,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -357734,17 +361735,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -357842,8 +361848,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -358014,24 +362020,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -358072,15 +362079,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -358127,8 +362135,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -358525,9 +362533,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -358589,7 +362597,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -358667,7 +362680,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -358807,17 +362820,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -358915,8 +362933,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -359087,24 +363105,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -359145,15 +363164,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -359200,8 +363220,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -359598,9 +363618,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -359662,7 +363682,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -359740,7 +363765,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -359880,17 +363905,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -359988,8 +364018,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -360160,24 +364190,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -360218,15 +364249,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -360273,8 +364305,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -360671,9 +364703,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -360735,7 +364767,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -360813,7 +364850,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -360953,17 +364990,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -361061,8 +365103,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -361233,24 +365275,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -361291,15 +365334,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -361346,8 +365390,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -361744,9 +365788,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -361808,7 +365852,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -361886,7 +365935,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -362026,17 +366075,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -362134,8 +366188,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -362306,24 +366360,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -362364,15 +366419,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -362419,8 +366475,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -362817,9 +366873,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -362881,7 +366937,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -362959,7 +367020,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -363099,17 +367160,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -363207,8 +367273,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -363379,24 +367445,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -363437,15 +367504,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -363492,8 +367560,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -363890,9 +367958,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -363954,7 +368022,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -364032,7 +368105,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -364172,17 +368245,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -364280,8 +368358,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -364452,24 +368530,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -364510,15 +368589,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -364565,8 +368645,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -364963,9 +369043,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -365027,7 +369107,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -365105,7 +369190,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -365245,17 +369330,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -365353,8 +369443,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -365525,24 +369615,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -365583,15 +369674,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -365638,8 +369730,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -366036,9 +370128,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -366100,7 +370192,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -366178,7 +370275,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -366318,17 +370415,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -366426,8 +370528,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -366598,24 +370700,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -366656,15 +370759,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -366711,8 +370815,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -367109,9 +371213,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -367173,7 +371277,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -367251,7 +371360,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -367391,17 +371500,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -367499,8 +371613,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -367671,24 +371785,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -367729,15 +371844,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -367784,8 +371900,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -368182,9 +372298,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -368246,7 +372362,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -368324,7 +372445,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -368464,17 +372585,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -368572,8 +372698,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -368744,24 +372870,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -368802,15 +372929,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -368857,8 +372985,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -369255,9 +373383,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -369319,7 +373447,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -369397,7 +373530,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -369537,17 +373670,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -369645,8 +373783,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -369817,24 +373955,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -369875,15 +374014,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -369930,8 +374070,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -370328,9 +374468,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -370392,7 +374532,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -370470,7 +374615,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -370610,17 +374755,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -370718,8 +374868,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -370890,24 +375040,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -370948,15 +375099,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -371003,8 +375155,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -371401,9 +375553,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -371465,7 +375617,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -371543,7 +375700,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -371683,17 +375840,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -371791,8 +375953,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -371963,24 +376125,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -372021,15 +376184,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -372076,8 +376240,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -372474,9 +376638,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -372538,7 +376702,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -372616,7 +376785,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -372756,17 +376925,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -372864,8 +377038,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -373036,24 +377210,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -373094,15 +377269,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -373149,8 +377325,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -373547,9 +377723,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -373611,7 +377787,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -373689,7 +377870,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -373829,17 +378010,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -373937,8 +378123,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -374109,24 +378295,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -374167,15 +378354,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -374222,8 +378410,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -374620,9 +378808,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -374684,7 +378872,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -374762,7 +378955,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -374902,17 +379095,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -375010,8 +379208,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -375182,24 +379380,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -375240,15 +379439,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -375295,8 +379495,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -375693,9 +379893,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -375757,7 +379957,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -375835,7 +380040,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -375975,17 +380180,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -376083,8 +380293,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -376255,24 +380465,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -376313,15 +380524,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -376368,8 +380580,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -376766,9 +380978,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -376830,7 +381042,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -376908,7 +381125,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -377048,17 +381265,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -377156,8 +381378,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -377328,24 +381550,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -377386,15 +381609,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -377441,8 +381665,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -377839,9 +382063,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -377903,7 +382127,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -377981,7 +382210,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -378121,17 +382350,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -378229,8 +382463,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -378401,24 +382635,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -378459,15 +382694,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -378514,8 +382750,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -378912,9 +383148,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -378976,7 +383212,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -379054,7 +383295,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -379194,17 +383435,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -379302,8 +383548,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -379474,24 +383720,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -379532,15 +383779,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -379587,8 +383835,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -379985,9 +384233,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -380049,7 +384297,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -380127,7 +384380,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -380267,17 +384520,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -380375,8 +384633,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -380547,24 +384805,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -380605,15 +384864,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -380660,8 +384920,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -381058,9 +385318,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -381122,7 +385382,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -381200,7 +385465,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -381340,17 +385605,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -381448,8 +385718,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -381620,24 +385890,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -381678,15 +385949,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -381733,8 +386005,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -382131,9 +386403,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -382195,7 +386467,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -382273,7 +386550,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -382413,17 +386690,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -382521,8 +386803,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -382693,24 +386975,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -382751,15 +387034,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -382806,8 +387090,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -383204,9 +387488,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -383268,7 +387552,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -383346,7 +387635,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -383486,17 +387775,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -383594,8 +387888,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -383766,24 +388060,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -383824,15 +388119,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -383879,8 +388175,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -384277,9 +388573,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -384341,7 +388637,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -384419,7 +388720,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -384559,17 +388860,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -384667,8 +388973,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -384839,24 +389145,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -384897,15 +389204,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -384952,8 +389260,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -385350,9 +389658,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -385414,7 +389722,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -385492,7 +389805,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -385632,17 +389945,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -385740,8 +390058,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -385912,24 +390230,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -385970,15 +390289,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -386025,8 +390345,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -386423,9 +390743,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -386487,7 +390807,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -386565,7 +390890,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -386705,17 +391030,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -386813,8 +391143,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -386985,24 +391315,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -387043,15 +391374,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -387098,8 +391430,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -387496,9 +391828,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -387560,7 +391892,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -387638,7 +391975,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -387778,17 +392115,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -387886,8 +392228,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -388058,24 +392400,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -388116,15 +392459,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -388171,8 +392515,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -388569,9 +392913,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -388633,7 +392977,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -388711,7 +393060,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -388851,17 +393200,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -388959,8 +393313,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -389131,24 +393485,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -389189,15 +393544,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -389244,8 +393600,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -389642,9 +393998,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -389706,7 +394062,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -389784,7 +394145,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -389924,17 +394285,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -390032,8 +394398,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -390204,24 +394570,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -390262,15 +394629,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -390317,8 +394685,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -390715,9 +395083,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -390779,7 +395147,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -390857,7 +395230,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -390997,17 +395370,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -391105,8 +395483,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -391277,24 +395655,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -391335,15 +395714,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -391390,8 +395770,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -391788,9 +396168,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -391852,7 +396232,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -391930,7 +396315,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -392070,17 +396455,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -392178,8 +396568,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -392350,24 +396740,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -392408,15 +396799,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -392463,8 +396855,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
@@ -392861,9 +397253,9 @@ T1110.002,No,-,0
 T1178,No,-,0
 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6
-T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
+T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
 T1003.004,No,-,0
 T1013,No,-,0
 T1600,No,-,0
@@ -392925,7 +397317,12 @@ T1218.004,No,-,0
 T1598.003,No,-,0
 T1021.004,No,-,0
 T1098.003,No,-,0
-T1547.012,No,-,0
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_adding_a_printer_driver.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/print_spooler_failed_to_load_a_plug_in.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_spawning_rundll32.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_loaded_modules.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll.yml,6
+T1547.012,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_writing_a_dll___sysmon.yml,6
 T1089,No,-,0
 T1487,No,-,0
 T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_application_spawn_rundll32_process.yml,12
@@ -393003,7 +397400,7 @@ T1005,No,-,0
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2
 T1137.005,No,-,0
-T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25
+T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,26
 T1586.002,No,-,0
 T1608.001,No,-,0
 T1195,No,-,0
@@ -393143,17 +397540,22 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3
 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3
 T1092,No,-,0
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,6
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,6
 T1585.002,No,-,0
 T1557.001,No,-,0
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6
-T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___deny_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___grant_permission_using_cacls_utility.yml,9
+T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml,9
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10
 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10
@@ -393251,8 +397653,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated
 T1036.002,No,-,0
 T1588.001,No,-,0
 T1542.002,No,-,0
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8
-T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,10
+T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,10
 T1048.001,No,-,0
 T1137.001,No,-,0
 T1583.003,No,-,0
@@ -393423,24 +397825,25 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,18
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,18
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml,19
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml,19
 T1565,No,-,0
 T1559,No,-,0
 T1001,No,-,0
@@ -393481,15 +397884,16 @@ T1571,No,-,0
 T1585.001,No,-,0
 T1073,No,-,0
 T1055.012,No,-,0
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,9
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,9
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/first_time_seen_child_process_of_zoom.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/spoolsv_suspicious_process_access.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,10
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,10
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_of_net_users.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_net_user_account.yml,3
 T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3
@@ -393536,8 +397940,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index 265c516bdd..25105f8c1b 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -173,7 +173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -245,7 +245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -346,7 +350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -535,15 +539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -655,7 +659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -871,8 +875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -906,8 +910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -977,7 +981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -1469,7 +1473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -1541,7 +1545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -1642,7 +1650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -1831,15 +1839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -1951,7 +1959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -2167,8 +2175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -2202,8 +2210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -2273,7 +2281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -2765,7 +2773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -2837,7 +2845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -2938,7 +2950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -3127,15 +3139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -3247,7 +3259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -3463,8 +3475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -3498,8 +3510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -3569,7 +3581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -4061,7 +4073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -4133,7 +4145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -4234,7 +4250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -4423,15 +4439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -4543,7 +4559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -4759,8 +4775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -4794,8 +4810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -4865,7 +4881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -5357,7 +5373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -5429,7 +5445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -5530,7 +5550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -5719,15 +5739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -5839,7 +5859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -6055,8 +6075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -6090,8 +6110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -6161,7 +6181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -6653,7 +6673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -6725,7 +6745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -6826,7 +6850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -7015,15 +7039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -7135,7 +7159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -7351,8 +7375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -7386,8 +7410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -7457,7 +7481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -7949,7 +7973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -8021,7 +8045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -8122,7 +8150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -8311,15 +8339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -8431,7 +8459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -8647,8 +8675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -8682,8 +8710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -8753,7 +8781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -9245,7 +9273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -9317,7 +9345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -9418,7 +9450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -9607,15 +9639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -9727,7 +9759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -9943,8 +9975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -9978,8 +10010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -10049,7 +10081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -10541,7 +10573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -10613,7 +10645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -10714,7 +10750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -10903,15 +10939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -11023,7 +11059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -11239,8 +11275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -11274,8 +11310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -11345,7 +11381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -11837,7 +11873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -11909,7 +11945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -12010,7 +12050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -12199,15 +12239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -12319,7 +12359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -12535,8 +12575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -12570,8 +12610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -12641,7 +12681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -13133,7 +13173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -13205,7 +13245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -13306,7 +13350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -13495,15 +13539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -13615,7 +13659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -13831,8 +13875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -13866,8 +13910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -13937,7 +13981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -14429,7 +14473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -14501,7 +14545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -14602,7 +14650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -14791,15 +14839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -14911,7 +14959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -15127,8 +15175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -15162,8 +15210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -15233,7 +15281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -15725,7 +15773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -15797,7 +15845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -15898,7 +15950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -16087,15 +16139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -16207,7 +16259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -16423,8 +16475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -16458,8 +16510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -16529,7 +16581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -17021,7 +17073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -17093,7 +17145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -17194,7 +17250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -17383,15 +17439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -17503,7 +17559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -17719,8 +17775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -17754,8 +17810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -17825,7 +17881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -18317,7 +18373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -18389,7 +18445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -18490,7 +18550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -18679,15 +18739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -18799,7 +18859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -19015,8 +19075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -19050,8 +19110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -19121,7 +19181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -19613,7 +19673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -19685,7 +19745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -19786,7 +19850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -19975,15 +20039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -20095,7 +20159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -20311,8 +20375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -20346,8 +20410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -20417,7 +20481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -20909,7 +20973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -20981,7 +21045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -21082,7 +21150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -21271,15 +21339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -21391,7 +21459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -21607,8 +21675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -21642,8 +21710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -21713,7 +21781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -22205,7 +22273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -22277,7 +22345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -22378,7 +22450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -22567,15 +22639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -22687,7 +22759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -22903,8 +22975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -22938,8 +23010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -23009,7 +23081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -23501,7 +23573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -23573,7 +23645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -23674,7 +23750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -23863,15 +23939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -23983,7 +24059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -24199,8 +24275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -24234,8 +24310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -24305,7 +24381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -24797,7 +24873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -24869,7 +24945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -24970,7 +25050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -25159,15 +25239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -25279,7 +25359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -25495,8 +25575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -25530,8 +25610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -25601,7 +25681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -26093,7 +26173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -26165,7 +26245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -26266,7 +26350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -26455,15 +26539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -26575,7 +26659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -26791,8 +26875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -26826,8 +26910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -26897,7 +26981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -27389,7 +27473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -27461,7 +27545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -27562,7 +27650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -27751,15 +27839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -27871,7 +27959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -28087,8 +28175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -28122,8 +28210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -28193,7 +28281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -28685,7 +28773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -28757,7 +28845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -28858,7 +28950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -29047,15 +29139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -29167,7 +29259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -29383,8 +29475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -29418,8 +29510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -29489,7 +29581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -29981,7 +30073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -30053,7 +30145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -30154,7 +30250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -30343,15 +30439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -30463,7 +30559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -30679,8 +30775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -30714,8 +30810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -30785,7 +30881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -31277,7 +31373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -31349,7 +31445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -31450,7 +31550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -31639,15 +31739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -31759,7 +31859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -31975,8 +32075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -32010,8 +32110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -32081,7 +32181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -32573,7 +32673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -32645,7 +32745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -32746,7 +32850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -32935,15 +33039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -33055,7 +33159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -33271,8 +33375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -33306,8 +33410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -33377,7 +33481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -33869,7 +33973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -33941,7 +34045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -34042,7 +34150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -34231,15 +34339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -34351,7 +34459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -34567,8 +34675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -34602,8 +34710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -34673,7 +34781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -35165,7 +35273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -35237,7 +35345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -35338,7 +35450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -35527,15 +35639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -35647,7 +35759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -35863,8 +35975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -35898,8 +36010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -35969,7 +36081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -36461,7 +36573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -36533,7 +36645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -36634,7 +36750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -36823,15 +36939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -36943,7 +37059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -37159,8 +37275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -37194,8 +37310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -37265,7 +37381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -37757,7 +37873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -37829,7 +37945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -37930,7 +38050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -38119,15 +38239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -38239,7 +38359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -38455,8 +38575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -38490,8 +38610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -38561,7 +38681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -39053,7 +39173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -39125,7 +39245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -39226,7 +39350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -39415,15 +39539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -39535,7 +39659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -39751,8 +39875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -39786,8 +39910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -39857,7 +39981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -40349,7 +40473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -40421,7 +40545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -40522,7 +40650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -40711,15 +40839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -40831,7 +40959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -41047,8 +41175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -41082,8 +41210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -41153,7 +41281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -41645,7 +41773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -41717,7 +41845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -41818,7 +41950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -42007,15 +42139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -42127,7 +42259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -42343,8 +42475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -42378,8 +42510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -42449,7 +42581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -42941,7 +43073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -43013,7 +43145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -43114,7 +43250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -43303,15 +43439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -43423,7 +43559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -43639,8 +43775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -43674,8 +43810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -43745,7 +43881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -44237,7 +44373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -44309,7 +44445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -44410,7 +44550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -44599,15 +44739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -44719,7 +44859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -44935,8 +45075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -44970,8 +45110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -45041,7 +45181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -45533,7 +45673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -45605,7 +45745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -45706,7 +45850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -45895,15 +46039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -46015,7 +46159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -46231,8 +46375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -46266,8 +46410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -46337,7 +46481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -46829,7 +46973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -46901,7 +47045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -47002,7 +47150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -47191,15 +47339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -47311,7 +47459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -47527,8 +47675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -47562,8 +47710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -47633,7 +47781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -48125,7 +48273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -48197,7 +48345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -48298,7 +48450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -48487,15 +48639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -48607,7 +48759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -48823,8 +48975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -48858,8 +49010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -48929,7 +49081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -49421,7 +49573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -49493,7 +49645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -49594,7 +49750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -49783,15 +49939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -49903,7 +50059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -50119,8 +50275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -50154,8 +50310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -50225,7 +50381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -50717,7 +50873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -50789,7 +50945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -50890,7 +51050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -51079,15 +51239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -51199,7 +51359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -51415,8 +51575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -51450,8 +51610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -51521,7 +51681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -52013,7 +52173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -52085,7 +52245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -52186,7 +52350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -52375,15 +52539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -52495,7 +52659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -52711,8 +52875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -52746,8 +52910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -52817,7 +52981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -53309,7 +53473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -53381,7 +53545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -53482,7 +53650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -53671,15 +53839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -53791,7 +53959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -54007,8 +54175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -54042,8 +54210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -54113,7 +54281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -54605,7 +54773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -54677,7 +54845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -54778,7 +54950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -54967,15 +55139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -55087,7 +55259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -55303,8 +55475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -55338,8 +55510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -55409,7 +55581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -55901,7 +56073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -55973,7 +56145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -56074,7 +56250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -56263,15 +56439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -56383,7 +56559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -56599,8 +56775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -56634,8 +56810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -56705,7 +56881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -57197,7 +57373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -57269,7 +57445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -57370,7 +57550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -57559,15 +57739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -57679,7 +57859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -57895,8 +58075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -57930,8 +58110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -58001,7 +58181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -58493,7 +58673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -58565,7 +58745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -58666,7 +58850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -58855,15 +59039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -58975,7 +59159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -59191,8 +59375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -59226,8 +59410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -59297,7 +59481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -59789,7 +59973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -59861,7 +60045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -59962,7 +60150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -60151,15 +60339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -60271,7 +60459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -60487,8 +60675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -60522,8 +60710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -60593,7 +60781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -61085,7 +61273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -61157,7 +61345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -61258,7 +61450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -61447,15 +61639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -61567,7 +61759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -61783,8 +61975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -61818,8 +62010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -61889,7 +62081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -62381,7 +62573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -62453,7 +62645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -62554,7 +62750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -62743,15 +62939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -62863,7 +63059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -63079,8 +63275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -63114,8 +63310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -63185,7 +63381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -63677,7 +63873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -63749,7 +63945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -63850,7 +64050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -64039,15 +64239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -64159,7 +64359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -64375,8 +64575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -64410,8 +64610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -64481,7 +64681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -64973,7 +65173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -65045,7 +65245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -65146,7 +65350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -65335,15 +65539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -65455,7 +65659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -65671,8 +65875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -65706,8 +65910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -65777,7 +65981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -66269,7 +66473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -66341,7 +66545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -66442,7 +66650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -66631,15 +66839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -66751,7 +66959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -66967,8 +67175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -67002,8 +67210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -67073,7 +67281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -67565,7 +67773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -67637,7 +67845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -67738,7 +67950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -67927,15 +68139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -68047,7 +68259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -68263,8 +68475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -68298,8 +68510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -68369,7 +68581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -68861,7 +69073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -68933,7 +69145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -69034,7 +69250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -69223,15 +69439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -69343,7 +69559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -69559,8 +69775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -69594,8 +69810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -69665,7 +69881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -70157,7 +70373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -70229,7 +70445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -70330,7 +70550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -70519,15 +70739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -70639,7 +70859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -70855,8 +71075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -70890,8 +71110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -70961,7 +71181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -71453,7 +71673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -71525,7 +71745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -71626,7 +71850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -71815,15 +72039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -71935,7 +72159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -72151,8 +72375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -72186,8 +72410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -72257,7 +72481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -72749,7 +72973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -72821,7 +73045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -72922,7 +73150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -73111,15 +73339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -73231,7 +73459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -73447,8 +73675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -73482,8 +73710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -73553,7 +73781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -74045,7 +74273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -74117,7 +74345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -74218,7 +74450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -74407,15 +74639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -74527,7 +74759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -74743,8 +74975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -74778,8 +75010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -74849,7 +75081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -75341,7 +75573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -75413,7 +75645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -75514,7 +75750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -75703,15 +75939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -75823,7 +76059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -76039,8 +76275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -76074,8 +76310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -76145,7 +76381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -76637,7 +76873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -76709,7 +76945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -76810,7 +77050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -76999,15 +77239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -77119,7 +77359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -77335,8 +77575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -77370,8 +77610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -77441,7 +77681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -77933,7 +78173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -78005,7 +78245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -78106,7 +78350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -78295,15 +78539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -78415,7 +78659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -78631,8 +78875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -78666,8 +78910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -78737,7 +78981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -79229,7 +79473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -79301,7 +79545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -79402,7 +79650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -79591,15 +79839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -79711,7 +79959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -79927,8 +80175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -79962,8 +80210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -80033,7 +80281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -80525,7 +80773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -80597,7 +80845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -80698,7 +80950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -80887,15 +81139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -81007,7 +81259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -81223,8 +81475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -81258,8 +81510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -81329,7 +81581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -81821,7 +82073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -81893,7 +82145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -81994,7 +82250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -82183,15 +82439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -82303,7 +82559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -82519,8 +82775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -82554,8 +82810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -82625,7 +82881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -83117,7 +83373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -83189,7 +83445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -83290,7 +83550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -83479,15 +83739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -83599,7 +83859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -83815,8 +84075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -83850,8 +84110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -83921,7 +84181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -84413,7 +84673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -84485,7 +84745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -84586,7 +84850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -84775,15 +85039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -84895,7 +85159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -85111,8 +85375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -85146,8 +85410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -85217,7 +85481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -85709,7 +85973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -85781,7 +86045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -85882,7 +86150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -86071,15 +86339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -86191,7 +86459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -86407,8 +86675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -86442,8 +86710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -86513,7 +86781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -87005,7 +87273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -87077,7 +87345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -87178,7 +87450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -87367,15 +87639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -87487,7 +87759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -87703,8 +87975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -87738,8 +88010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -87809,7 +88081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -88301,7 +88573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -88373,7 +88645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -88474,7 +88750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -88663,15 +88939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -88783,7 +89059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -88999,8 +89275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -89034,8 +89310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -89105,7 +89381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -89597,7 +89873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -89669,7 +89945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -89770,7 +90050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -89959,15 +90239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -90079,7 +90359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -90295,8 +90575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -90330,8 +90610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -90401,7 +90681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -90893,7 +91173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -90965,7 +91245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -91066,7 +91350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -91255,15 +91539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -91375,7 +91659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -91591,8 +91875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -91626,8 +91910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -91697,7 +91981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -92189,7 +92473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -92261,7 +92545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -92362,7 +92650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -92551,15 +92839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -92671,7 +92959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -92887,8 +93175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -92922,8 +93210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -92993,7 +93281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -93485,7 +93773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -93557,7 +93845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -93658,7 +93950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -93847,15 +94139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -93967,7 +94259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -94183,8 +94475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -94218,8 +94510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -94289,7 +94581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -94781,7 +95073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -94853,7 +95145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -94954,7 +95250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -95143,15 +95439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -95263,7 +95559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -95479,8 +95775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -95514,8 +95810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -95585,7 +95881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -96077,7 +96373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -96149,7 +96445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -96250,7 +96550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -96439,15 +96739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -96559,7 +96859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -96775,8 +97075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -96810,8 +97110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -96881,7 +97181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -97373,7 +97673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -97445,7 +97745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -97546,7 +97850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -97735,15 +98039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -97855,7 +98159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -98071,8 +98375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -98106,8 +98410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -98177,7 +98481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -98669,7 +98973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -98741,7 +99045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -98842,7 +99150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -99031,15 +99339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -99151,7 +99459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -99367,8 +99675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -99402,8 +99710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -99473,7 +99781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -99965,7 +100273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -100037,7 +100345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -100138,7 +100450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -100327,15 +100639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -100447,7 +100759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -100663,8 +100975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -100698,8 +101010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -100769,7 +101081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -101261,7 +101573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -101333,7 +101645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -101434,7 +101750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -101623,15 +101939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -101743,7 +102059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -101959,8 +102275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -101994,8 +102310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -102065,7 +102381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -102557,7 +102873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -102629,7 +102945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -102730,7 +103050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -102919,15 +103239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -103039,7 +103359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -103255,8 +103575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -103290,8 +103610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -103361,7 +103681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -103853,7 +104173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -103925,7 +104245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -104026,7 +104350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -104215,15 +104539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -104335,7 +104659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -104551,8 +104875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -104586,8 +104910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -104657,7 +104981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -105149,7 +105473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -105221,7 +105545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -105322,7 +105650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -105511,15 +105839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -105631,7 +105959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -105847,8 +106175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -105882,8 +106210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -105953,7 +106281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -106445,7 +106773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -106517,7 +106845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -106618,7 +106950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -106807,15 +107139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -106927,7 +107259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -107143,8 +107475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -107178,8 +107510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -107249,7 +107581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -107741,7 +108073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -107813,7 +108145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -107914,7 +108250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -108103,15 +108439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -108223,7 +108559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -108439,8 +108775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -108474,8 +108810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -108545,7 +108881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -109037,7 +109373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -109109,7 +109445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -109210,7 +109550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -109399,15 +109739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -109519,7 +109859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -109735,8 +110075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -109770,8 +110110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -109841,7 +110181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -110333,7 +110673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -110405,7 +110745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -110506,7 +110850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -110695,15 +111039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -110815,7 +111159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -111031,8 +111375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -111066,8 +111410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -111137,7 +111481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -111629,7 +111973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -111701,7 +112045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -111802,7 +112150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -111991,15 +112339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -112111,7 +112459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -112327,8 +112675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -112362,8 +112710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -112433,7 +112781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -112925,7 +113273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -112997,7 +113345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -113098,7 +113450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -113287,15 +113639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -113407,7 +113759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -113623,8 +113975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -113658,8 +114010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -113729,7 +114081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -114221,7 +114573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -114293,7 +114645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -114394,7 +114750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -114583,15 +114939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -114703,7 +115059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -114919,8 +115275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -114954,8 +115310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -115025,7 +115381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -115517,7 +115873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -115589,7 +115945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -115690,7 +116050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -115879,15 +116239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -115999,7 +116359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -116215,8 +116575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -116250,8 +116610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -116321,7 +116681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -116813,7 +117173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -116885,7 +117245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -116986,7 +117350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -117175,15 +117539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -117295,7 +117659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -117511,8 +117875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -117546,8 +117910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -117617,7 +117981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -118109,7 +118473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -118181,7 +118545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -118282,7 +118650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -118471,15 +118839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -118591,7 +118959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -118807,8 +119175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -118842,8 +119210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -118913,7 +119281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -119405,7 +119773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -119477,7 +119845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -119578,7 +119950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -119767,15 +120139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -119887,7 +120259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -120103,8 +120475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -120138,8 +120510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -120209,7 +120581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -120701,7 +121073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -120773,7 +121145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -120874,7 +121250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -121063,15 +121439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -121183,7 +121559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -121399,8 +121775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -121434,8 +121810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -121505,7 +121881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -121997,7 +122373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -122069,7 +122445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -122170,7 +122550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -122359,15 +122739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -122479,7 +122859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -122695,8 +123075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -122730,8 +123110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -122801,7 +123181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -123293,7 +123673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -123365,7 +123745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -123466,7 +123850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -123655,15 +124039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -123775,7 +124159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -123991,8 +124375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -124026,8 +124410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -124097,7 +124481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -124589,7 +124973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -124661,7 +125045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -124762,7 +125150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -124951,15 +125339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -125071,7 +125459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -125287,8 +125675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -125322,8 +125710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -125393,7 +125781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -125885,7 +126273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -125957,7 +126345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -126058,7 +126450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -126247,15 +126639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -126367,7 +126759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -126583,8 +126975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -126618,8 +127010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -126689,7 +127081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -127181,7 +127573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -127253,7 +127645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -127354,7 +127750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -127543,15 +127939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -127663,7 +128059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -127879,8 +128275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -127914,8 +128310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -127985,7 +128381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -128477,7 +128873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -128549,7 +128945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -128650,7 +129050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -128839,15 +129239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -128959,7 +129359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -129175,8 +129575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -129210,8 +129610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -129281,7 +129681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -129773,7 +130173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -129845,7 +130245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -129946,7 +130350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -130135,15 +130539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -130255,7 +130659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -130471,8 +130875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -130506,8 +130910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -130577,7 +130981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -131069,7 +131473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -131141,7 +131545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -131242,7 +131650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -131431,15 +131839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -131551,7 +131959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -131767,8 +132175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -131802,8 +132210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -131873,7 +132281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -132365,7 +132773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -132437,7 +132845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -132538,7 +132950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -132727,15 +133139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -132847,7 +133259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -133063,8 +133475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -133098,8 +133510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -133169,7 +133581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -133661,7 +134073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -133733,7 +134145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -133834,7 +134250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -134023,15 +134439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -134143,7 +134559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -134359,8 +134775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -134394,8 +134810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -134465,7 +134881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -134957,7 +135373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -135029,7 +135445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -135130,7 +135550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -135319,15 +135739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -135439,7 +135859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -135655,8 +136075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -135690,8 +136110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -135761,7 +136181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -136253,7 +136673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -136325,7 +136745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -136426,7 +136850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -136615,15 +137039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -136735,7 +137159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -136951,8 +137375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -136986,8 +137410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -137057,7 +137481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -137549,7 +137973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -137621,7 +138045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -137722,7 +138150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -137911,15 +138339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -138031,7 +138459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -138247,8 +138675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -138282,8 +138710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -138353,7 +138781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -138845,7 +139273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -138917,7 +139345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -139018,7 +139450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -139207,15 +139639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -139327,7 +139759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -139543,8 +139975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -139578,8 +140010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -139649,7 +140081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -140141,7 +140573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -140213,7 +140645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -140314,7 +140750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -140503,15 +140939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -140623,7 +141059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -140839,8 +141275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -140874,8 +141310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -140945,7 +141381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -141437,7 +141873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -141509,7 +141945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -141610,7 +142050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -141799,15 +142239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -141919,7 +142359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -142135,8 +142575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -142170,8 +142610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -142241,7 +142681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -142733,7 +143173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -142805,7 +143245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -142906,7 +143350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -143095,15 +143539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -143215,7 +143659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -143431,8 +143875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -143466,8 +143910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -143537,7 +143981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -144029,7 +144473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -144101,7 +144545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -144202,7 +144650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -144391,15 +144839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -144511,7 +144959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -144727,8 +145175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -144762,8 +145210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -144833,7 +145281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -145325,7 +145773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -145397,7 +145845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -145498,7 +145950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -145687,15 +146139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -145807,7 +146259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -146023,8 +146475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -146058,8 +146510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -146129,7 +146581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -146621,7 +147073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -146693,7 +147145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -146794,7 +147250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -146983,15 +147439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -147103,7 +147559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -147319,8 +147775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -147354,8 +147810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -147425,7 +147881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -147917,7 +148373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -147989,7 +148445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -148090,7 +148550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -148279,15 +148739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -148399,7 +148859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -148615,8 +149075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -148650,8 +149110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -148721,7 +149181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -149213,7 +149673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -149285,7 +149745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -149386,7 +149850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -149575,15 +150039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -149695,7 +150159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -149911,8 +150375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -149946,8 +150410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -150017,7 +150481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -150509,7 +150973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -150581,7 +151045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -150682,7 +151150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -150871,15 +151339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -150991,7 +151459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -151207,8 +151675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -151242,8 +151710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -151313,7 +151781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -151805,7 +152273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -151877,7 +152345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -151978,7 +152450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -152167,15 +152639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -152287,7 +152759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -152503,8 +152975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -152538,8 +153010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -152609,7 +153081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -153101,7 +153573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -153173,7 +153645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -153274,7 +153750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -153463,15 +153939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -153583,7 +154059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -153799,8 +154275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -153834,8 +154310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -153905,7 +154381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -154397,7 +154873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -154469,7 +154945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -154570,7 +155050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -154759,15 +155239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -154879,7 +155359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -155095,8 +155575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -155130,8 +155610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -155201,7 +155681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -155693,7 +156173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -155765,7 +156245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -155866,7 +156350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -156055,15 +156539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -156175,7 +156659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -156391,8 +156875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -156426,8 +156910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -156497,7 +156981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -156989,7 +157473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -157061,7 +157545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -157162,7 +157650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -157351,15 +157839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -157471,7 +157959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -157687,8 +158175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -157722,8 +158210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -157793,7 +158281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -158285,7 +158773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -158357,7 +158845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -158458,7 +158950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -158647,15 +159139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -158767,7 +159259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -158983,8 +159475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -159018,8 +159510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -159089,7 +159581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -159581,7 +160073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -159653,7 +160145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -159754,7 +160250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -159943,15 +160439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -160063,7 +160559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -160279,8 +160775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -160314,8 +160810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -160385,7 +160881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -160877,7 +161373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -160949,7 +161445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -161050,7 +161550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -161239,15 +161739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -161359,7 +161859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -161575,8 +162075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -161610,8 +162110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -161681,7 +162181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -162173,7 +162673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -162245,7 +162745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -162346,7 +162850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -162535,15 +163039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -162655,7 +163159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -162871,8 +163375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -162906,8 +163410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -162977,7 +163481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -163469,7 +163973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -163541,7 +164045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -163642,7 +164150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -163831,15 +164339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -163951,7 +164459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -164167,8 +164675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -164202,8 +164710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -164273,7 +164781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -164765,7 +165273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -164837,7 +165345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -164938,7 +165450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -165127,15 +165639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -165247,7 +165759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -165463,8 +165975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -165498,8 +166010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -165569,7 +166081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -166061,7 +166573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -166133,7 +166645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -166234,7 +166750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -166423,15 +166939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -166543,7 +167059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -166759,8 +167275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -166794,8 +167310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -166865,7 +167381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -167357,7 +167873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -167429,7 +167945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -167530,7 +168050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -167719,15 +168239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -167839,7 +168359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -168055,8 +168575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -168090,8 +168610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -168161,7 +168681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -168653,7 +169173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -168725,7 +169245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -168826,7 +169350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -169015,15 +169539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -169135,7 +169659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -169351,8 +169875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -169386,8 +169910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -169457,7 +169981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -169949,7 +170473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -170021,7 +170545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -170122,7 +170650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -170311,15 +170839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -170431,7 +170959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -170647,8 +171175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -170682,8 +171210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -170753,7 +171281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -171245,7 +171773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -171317,7 +171845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -171418,7 +171950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -171607,15 +172139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -171727,7 +172259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -171943,8 +172475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -171978,8 +172510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -172049,7 +172581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -172541,7 +173073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -172613,7 +173145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -172714,7 +173250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -172903,15 +173439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -173023,7 +173559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -173239,8 +173775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -173274,8 +173810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -173345,7 +173881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -173837,7 +174373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -173909,7 +174445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -174010,7 +174550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -174199,15 +174739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -174319,7 +174859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -174535,8 +175075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -174570,8 +175110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -174641,7 +175181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -175133,7 +175673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -175205,7 +175745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -175306,7 +175850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -175495,15 +176039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -175615,7 +176159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -175831,8 +176375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -175866,8 +176410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -175937,7 +176481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -176429,7 +176973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -176501,7 +177045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -176602,7 +177150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -176791,15 +177339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -176911,7 +177459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -177127,8 +177675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -177162,8 +177710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -177233,7 +177781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -177725,7 +178273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -177797,7 +178345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -177898,7 +178450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -178087,15 +178639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -178207,7 +178759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -178423,8 +178975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -178458,8 +179010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -178529,7 +179081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -179021,7 +179573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -179093,7 +179645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -179194,7 +179750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -179383,15 +179939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -179503,7 +180059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -179719,8 +180275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -179754,8 +180310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -179825,7 +180381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -180317,7 +180873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -180389,7 +180945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -180490,7 +181050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -180679,15 +181239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -180799,7 +181359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -181015,8 +181575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -181050,8 +181610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -181121,7 +181681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -181613,7 +182173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -181685,7 +182245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -181786,7 +182350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -181975,15 +182539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -182095,7 +182659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -182311,8 +182875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -182346,8 +182910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -182417,7 +182981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -182909,7 +183473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -182981,7 +183545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -183082,7 +183650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -183271,15 +183839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -183391,7 +183959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -183607,8 +184175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -183642,8 +184210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -183713,7 +184281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -184205,7 +184773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -184277,7 +184845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -184378,7 +184950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -184567,15 +185139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -184687,7 +185259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -184903,8 +185475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -184938,8 +185510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -185009,7 +185581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -185501,7 +186073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -185573,7 +186145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -185674,7 +186250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -185863,15 +186439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -185983,7 +186559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -186199,8 +186775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -186234,8 +186810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -186305,7 +186881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -186797,7 +187373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -186869,7 +187445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -186970,7 +187550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -187159,15 +187739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -187279,7 +187859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -187495,8 +188075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -187530,8 +188110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -187601,7 +188181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -188093,7 +188673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -188165,7 +188745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -188266,7 +188850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -188455,15 +189039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -188575,7 +189159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -188791,8 +189375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -188826,8 +189410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -188897,7 +189481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -189389,7 +189973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -189461,7 +190045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -189562,7 +190150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -189751,15 +190339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -189871,7 +190459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -190087,8 +190675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -190122,8 +190710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -190193,7 +190781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -190685,7 +191273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -190757,7 +191345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -190858,7 +191450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -191047,15 +191639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -191167,7 +191759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -191383,8 +191975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -191418,8 +192010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -191489,7 +192081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -191981,7 +192573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -192053,7 +192645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -192154,7 +192750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -192343,15 +192939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -192463,7 +193059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -192679,8 +193275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -192714,8 +193310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -192785,7 +193381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -193277,7 +193873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -193349,7 +193945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -193450,7 +194050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -193639,15 +194239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -193759,7 +194359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -193975,8 +194575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -194010,8 +194610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -194081,7 +194681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -194573,7 +195173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -194645,7 +195245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -194746,7 +195350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -194935,15 +195539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -195055,7 +195659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -195271,8 +195875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -195306,8 +195910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -195377,7 +195981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -195869,7 +196473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -195941,7 +196545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -196042,7 +196650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -196231,15 +196839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -196351,7 +196959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -196567,8 +197175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -196602,8 +197210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -196673,7 +197281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -197165,7 +197773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -197237,7 +197845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -197338,7 +197950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -197527,15 +198139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -197647,7 +198259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -197863,8 +198475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -197898,8 +198510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -197969,7 +198581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -198461,7 +199073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -198533,7 +199145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -198634,7 +199250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -198823,15 +199439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -198943,7 +199559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -199159,8 +199775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -199194,8 +199810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -199265,7 +199881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -199757,7 +200373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -199829,7 +200445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -199930,7 +200550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -200119,15 +200739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -200239,7 +200859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -200455,8 +201075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -200490,8 +201110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -200561,7 +201181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -201053,7 +201673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -201125,7 +201745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -201226,7 +201850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -201415,15 +202039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -201535,7 +202159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -201751,8 +202375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -201786,8 +202410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -201857,7 +202481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -202349,7 +202973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -202421,7 +203045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -202522,7 +203150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -202711,15 +203339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -202831,7 +203459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -203047,8 +203675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -203082,8 +203710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -203153,7 +203781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -203645,7 +204273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -203717,7 +204345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -203818,7 +204450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -204007,15 +204639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -204127,7 +204759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -204343,8 +204975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -204378,8 +205010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -204449,7 +205081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -204941,7 +205573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -205013,7 +205645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -205114,7 +205750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -205303,15 +205939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -205423,7 +206059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -205639,8 +206275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -205674,8 +206310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -205745,7 +206381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -206237,7 +206873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -206309,7 +206945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -206410,7 +207050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -206599,15 +207239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -206719,7 +207359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -206935,8 +207575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -206970,8 +207610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -207041,7 +207681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -207533,7 +208173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -207605,7 +208245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -207706,7 +208350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -207895,15 +208539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -208015,7 +208659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -208231,8 +208875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -208266,8 +208910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -208337,7 +208981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -208829,7 +209473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -208901,7 +209545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -209002,7 +209650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -209191,15 +209839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -209311,7 +209959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -209527,8 +210175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -209562,8 +210210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -209633,7 +210281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -210125,7 +210773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -210197,7 +210845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -210298,7 +210950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -210487,15 +211139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -210607,7 +211259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -210823,8 +211475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -210858,8 +211510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -210929,7 +211581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -211421,7 +212073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -211493,7 +212145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -211594,7 +212250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -211783,15 +212439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -211903,7 +212559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -212119,8 +212775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -212154,8 +212810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -212225,7 +212881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -212717,7 +213373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -212789,7 +213445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -212890,7 +213550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -213079,15 +213739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -213199,7 +213859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -213415,8 +214075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -213450,8 +214110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -213521,7 +214181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -214013,7 +214673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -214085,7 +214745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -214186,7 +214850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -214375,15 +215039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -214495,7 +215159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -214711,8 +215375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -214746,8 +215410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -214817,7 +215481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -215309,7 +215973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -215381,7 +216045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -215482,7 +216150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -215671,15 +216339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -215791,7 +216459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -216007,8 +216675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -216042,8 +216710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -216113,7 +216781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -216605,7 +217273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -216677,7 +217345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -216778,7 +217450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -216967,15 +217639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -217087,7 +217759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -217303,8 +217975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -217338,8 +218010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -217409,7 +218081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -217901,7 +218573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -217973,7 +218645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -218074,7 +218750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -218263,15 +218939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -218383,7 +219059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -218599,8 +219275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -218634,8 +219310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -218705,7 +219381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -219197,7 +219873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -219269,7 +219945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -219370,7 +220050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -219559,15 +220239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -219679,7 +220359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -219895,8 +220575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -219930,8 +220610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -220001,7 +220681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -220493,7 +221173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -220565,7 +221245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -220666,7 +221350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -220855,15 +221539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -220975,7 +221659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -221191,8 +221875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -221226,8 +221910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -221297,7 +221981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -221789,7 +222473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -221861,7 +222545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -221962,7 +222650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -222151,15 +222839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -222271,7 +222959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -222487,8 +223175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -222522,8 +223210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -222593,7 +223281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -223085,7 +223773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -223157,7 +223845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -223258,7 +223950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -223447,15 +224139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -223567,7 +224259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -223783,8 +224475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -223818,8 +224510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -223889,7 +224581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -224381,7 +225073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -224453,7 +225145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -224554,7 +225250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -224743,15 +225439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -224863,7 +225559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -225079,8 +225775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -225114,8 +225810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -225185,7 +225881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -225677,7 +226373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -225749,7 +226445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -225850,7 +226550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -226039,15 +226739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -226159,7 +226859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -226375,8 +227075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -226410,8 +227110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -226481,7 +227181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -226973,7 +227673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -227045,7 +227745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -227146,7 +227850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -227335,15 +228039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -227455,7 +228159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -227671,8 +228375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -227706,8 +228410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -227777,7 +228481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -228269,7 +228973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -228341,7 +229045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -228442,7 +229150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -228631,15 +229339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -228751,7 +229459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -228967,8 +229675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -229002,8 +229710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -229073,7 +229781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -229565,7 +230273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -229637,7 +230345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -229738,7 +230450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -229927,15 +230639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -230047,7 +230759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -230263,8 +230975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -230298,8 +231010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -230369,7 +231081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -230861,7 +231573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -230933,7 +231645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -231034,7 +231750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -231223,15 +231939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -231343,7 +232059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -231559,8 +232275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -231594,8 +232310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -231665,7 +232381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -232157,7 +232873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -232229,7 +232945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -232330,7 +233050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -232519,15 +233239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -232639,7 +233359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -232855,8 +233575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -232890,8 +233610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -232961,7 +233681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -233453,7 +234173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -233525,7 +234245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -233626,7 +234350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -233815,15 +234539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -233935,7 +234659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -234151,8 +234875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -234186,8 +234910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -234257,7 +234981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -234749,7 +235473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -234821,7 +235545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -234922,7 +235650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -235111,15 +235839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -235231,7 +235959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -235447,8 +236175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -235482,8 +236210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -235553,7 +236281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -236045,7 +236773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -236117,7 +236845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -236218,7 +236950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -236407,15 +237139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -236527,7 +237259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -236743,8 +237475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -236778,8 +237510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -236849,7 +237581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -237341,7 +238073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -237413,7 +238145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -237514,7 +238250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -237703,15 +238439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -237823,7 +238559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -238039,8 +238775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -238074,8 +238810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -238145,7 +238881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -238637,7 +239373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -238709,7 +239445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -238810,7 +239550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -238999,15 +239739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -239119,7 +239859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -239335,8 +240075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -239370,8 +240110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -239441,7 +240181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -239933,7 +240673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -240005,7 +240745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -240106,7 +240850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -240295,15 +241039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -240415,7 +241159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -240631,8 +241375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -240666,8 +241410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -240737,7 +241481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -241229,7 +241973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -241301,7 +242045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -241402,7 +242150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -241591,15 +242339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -241711,7 +242459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -241927,8 +242675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -241962,8 +242710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -242033,7 +242781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -242525,7 +243273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -242597,7 +243345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -242698,7 +243450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -242887,15 +243639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -243007,7 +243759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -243223,8 +243975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -243258,8 +244010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -243329,7 +244081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -243821,7 +244573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -243893,7 +244645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -243994,7 +244750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -244183,15 +244939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -244303,7 +245059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -244519,8 +245275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -244554,8 +245310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -244625,7 +245381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -245117,7 +245873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -245189,7 +245945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -245290,7 +246050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -245479,15 +246239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -245599,7 +246359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -245815,8 +246575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -245850,8 +246610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -245921,7 +246681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -246413,7 +247173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -246485,7 +247245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -246586,7 +247350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -246775,15 +247539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -246895,7 +247659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -247111,8 +247875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -247146,8 +247910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -247217,7 +247981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -247709,7 +248473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -247781,7 +248545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -247882,7 +248650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -248071,15 +248839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -248191,7 +248959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -248407,8 +249175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -248442,8 +249210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -248513,7 +249281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -249005,7 +249773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -249077,7 +249845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -249178,7 +249950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -249367,15 +250139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -249487,7 +250259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -249703,8 +250475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -249738,8 +250510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -249809,7 +250581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -250301,7 +251073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -250373,7 +251145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -250474,7 +251250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -250663,15 +251439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -250783,7 +251559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -250999,8 +251775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -251034,8 +251810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -251105,7 +251881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -251597,7 +252373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -251669,7 +252445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -251770,7 +252550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -251959,15 +252739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -252079,7 +252859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -252295,8 +253075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -252330,8 +253110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -252401,7 +253181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -252893,7 +253673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -252965,7 +253745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -253066,7 +253850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -253255,15 +254039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -253375,7 +254159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -253591,8 +254375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -253626,8 +254410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -253697,7 +254481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -254189,7 +254973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -254261,7 +255045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -254362,7 +255150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -254551,15 +255339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -254671,7 +255459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -254887,8 +255675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -254922,8 +255710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -254993,7 +255781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -255485,7 +256273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -255557,7 +256345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -255658,7 +256450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -255847,15 +256639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -255967,7 +256759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -256183,8 +256975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -256218,8 +257010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -256289,7 +257081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -256781,7 +257573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -256853,7 +257645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -256954,7 +257750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -257143,15 +257939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -257263,7 +258059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -257479,8 +258275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -257514,8 +258310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -257585,7 +258381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -258077,7 +258873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -258149,7 +258945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -258250,7 +259050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -258439,15 +259239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -258559,7 +259359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -258775,8 +259575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -258810,8 +259610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -258881,7 +259681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -259373,7 +260173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -259445,7 +260245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -259546,7 +260350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -259735,15 +260539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -259855,7 +260659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -260071,8 +260875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -260106,8 +260910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -260177,7 +260981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -260669,7 +261473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -260741,7 +261545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -260842,7 +261650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -261031,15 +261839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -261151,7 +261959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -261367,8 +262175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -261402,8 +262210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -261473,7 +262281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -261965,7 +262773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -262037,7 +262845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -262138,7 +262950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -262327,15 +263139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -262447,7 +263259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -262663,8 +263475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -262698,8 +263510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -262769,7 +263581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -263261,7 +264073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -263333,7 +264145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -263434,7 +264250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -263623,15 +264439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -263743,7 +264559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -263959,8 +264775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -263994,8 +264810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -264065,7 +264881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -264557,7 +265373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -264629,7 +265445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -264730,7 +265550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -264919,15 +265739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -265039,7 +265859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -265255,8 +266075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -265290,8 +266110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -265361,7 +266181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -265853,7 +266673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -265925,7 +266745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -266026,7 +266850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -266215,15 +267039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -266335,7 +267159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -266551,8 +267375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -266586,8 +267410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -266657,7 +267481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -267149,7 +267973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -267221,7 +268045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -267322,7 +268150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -267511,15 +268339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -267631,7 +268459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -267847,8 +268675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -267882,8 +268710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -267953,7 +268781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -268445,7 +269273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -268517,7 +269345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -268618,7 +269450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -268807,15 +269639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -268927,7 +269759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -269143,8 +269975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -269178,8 +270010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -269249,7 +270081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -269741,7 +270573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -269813,7 +270645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -269914,7 +270750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -270103,15 +270939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -270223,7 +271059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -270439,8 +271275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -270474,8 +271310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -270545,7 +271381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -271037,7 +271873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -271109,7 +271945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -271210,7 +272050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -271399,15 +272239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -271519,7 +272359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -271735,8 +272575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -271770,8 +272610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -271841,7 +272681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -272333,7 +273173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -272405,7 +273245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -272506,7 +273350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -272695,15 +273539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -272815,7 +273659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -273031,8 +273875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -273066,8 +273910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -273137,7 +273981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -273629,7 +274473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -273701,7 +274545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -273802,7 +274650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -273991,15 +274839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -274111,7 +274959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -274327,8 +275175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -274362,8 +275210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -274433,7 +275281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -274925,7 +275773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -274997,7 +275845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -275098,7 +275950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -275287,15 +276139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -275407,7 +276259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -275623,8 +276475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -275658,8 +276510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -275729,7 +276581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -276221,7 +277073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -276293,7 +277145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -276394,7 +277250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -276583,15 +277439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -276703,7 +277559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -276919,8 +277775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -276954,8 +277810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -277025,7 +277881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -277517,7 +278373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -277589,7 +278445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -277690,7 +278550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -277879,15 +278739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -277999,7 +278859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -278215,8 +279075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -278250,8 +279110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -278321,7 +279181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -278813,7 +279673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -278885,7 +279745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -278986,7 +279850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -279175,15 +280039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -279295,7 +280159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -279511,8 +280375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -279546,8 +280410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -279617,7 +280481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -280109,7 +280973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -280181,7 +281045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -280282,7 +281150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -280471,15 +281339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -280591,7 +281459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -280807,8 +281675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -280842,8 +281710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -280913,7 +281781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -281405,7 +282273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -281477,7 +282345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -281578,7 +282450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -281767,15 +282639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -281887,7 +282759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -282103,8 +282975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -282138,8 +283010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -282209,7 +283081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -282701,7 +283573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -282773,7 +283645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -282874,7 +283750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -283063,15 +283939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -283183,7 +284059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -283399,8 +284275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -283434,8 +284310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -283505,7 +284381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -283997,7 +284873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -284069,7 +284945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -284170,7 +285050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -284359,15 +285239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -284479,7 +285359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -284695,8 +285575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -284730,8 +285610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -284801,7 +285681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -285293,7 +286173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -285365,7 +286245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -285466,7 +286350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -285655,15 +286539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -285775,7 +286659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -285991,8 +286875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -286026,8 +286910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -286097,7 +286981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -286589,7 +287473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -286661,7 +287545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -286762,7 +287650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -286951,15 +287839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -287071,7 +287959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -287287,8 +288175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -287322,8 +288210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -287393,7 +288281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -287885,7 +288773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -287957,7 +288845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -288058,7 +288950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -288247,15 +289139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -288367,7 +289259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -288583,8 +289475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -288618,8 +289510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -288689,7 +289581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -289181,7 +290073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -289253,7 +290145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -289354,7 +290250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -289543,15 +290439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -289663,7 +290559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -289879,8 +290775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -289914,8 +290810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -289985,7 +290881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -290477,7 +291373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -290549,7 +291445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -290650,7 +291550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -290839,15 +291739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -290959,7 +291859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -291175,8 +292075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -291210,8 +292110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -291281,7 +292181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -291773,7 +292673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -291845,7 +292745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -291946,7 +292850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -292135,15 +293039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -292255,7 +293159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -292471,8 +293375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -292506,8 +293410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -292577,7 +293481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -293069,7 +293973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -293141,7 +294045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -293242,7 +294150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -293431,15 +294339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -293551,7 +294459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -293767,8 +294675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -293802,8 +294710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -293873,7 +294781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -294365,7 +295273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -294437,7 +295345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -294538,7 +295450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -294727,15 +295639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -294847,7 +295759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -295063,8 +295975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -295098,8 +296010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -295169,7 +296081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -295661,7 +296573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -295733,7 +296645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -295834,7 +296750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -296023,15 +296939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -296143,7 +297059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -296359,8 +297275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -296394,8 +297310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -296465,7 +297381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -296957,7 +297873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -297029,7 +297945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -297130,7 +298050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -297319,15 +298239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -297439,7 +298359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -297655,8 +298575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -297690,8 +298610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -297761,7 +298681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -298253,7 +299173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -298325,7 +299245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -298426,7 +299350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -298615,15 +299539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -298735,7 +299659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -298951,8 +299875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -298986,8 +299910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -299057,7 +299981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -299549,7 +300473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -299621,7 +300545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -299722,7 +300650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -299911,15 +300839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -300031,7 +300959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -300247,8 +301175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -300282,8 +301210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -300353,7 +301281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -300845,7 +301773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -300917,7 +301845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -301018,7 +301950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -301207,15 +302139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -301327,7 +302259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -301543,8 +302475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -301578,8 +302510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -301649,7 +302581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -302141,7 +303073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -302213,7 +303145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -302314,7 +303250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -302503,15 +303439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -302623,7 +303559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -302839,8 +303775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -302874,8 +303810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -302945,7 +303881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -303437,7 +304373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -303509,7 +304445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -303610,7 +304550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -303799,15 +304739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -303919,7 +304859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -304135,8 +305075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -304170,8 +305110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -304241,7 +305181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -304733,7 +305673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -304805,7 +305745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -304906,7 +305850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -305095,15 +306039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -305215,7 +306159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -305431,8 +306375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -305466,8 +306410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -305537,7 +306481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -306029,7 +306973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -306101,7 +307045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -306202,7 +307150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -306391,15 +307339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -306511,7 +307459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -306727,8 +307675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -306762,8 +307710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -306833,7 +307781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -307325,7 +308273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -307397,7 +308345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -307498,7 +308450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -307687,15 +308639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -307807,7 +308759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -308023,8 +308975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -308058,8 +309010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -308129,7 +309081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -308621,7 +309573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -308693,7 +309645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -308794,7 +309750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -308983,15 +309939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -309103,7 +310059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -309319,8 +310275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -309354,8 +310310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -309425,7 +310381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -309917,7 +310873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -309989,7 +310945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -310090,7 +311050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -310279,15 +311239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -310399,7 +311359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -310615,8 +311575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -310650,8 +311610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -310721,7 +311681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -311213,7 +312173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -311285,7 +312245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -311386,7 +312350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -311575,15 +312539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -311695,7 +312659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -311911,8 +312875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -311946,8 +312910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -312017,7 +312981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -312509,7 +313473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -312581,7 +313545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -312682,7 +313650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -312871,15 +313839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -312991,7 +313959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -313207,8 +314175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -313242,8 +314210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -313313,7 +314281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -313805,7 +314773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -313877,7 +314845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -313978,7 +314950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -314167,15 +315139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -314287,7 +315259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -314503,8 +315475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -314538,8 +315510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -314609,7 +315581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -315101,7 +316073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -315173,7 +316145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -315274,7 +316250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -315463,15 +316439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -315583,7 +316559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -315799,8 +316775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -315834,8 +316810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -315905,7 +316881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -316397,7 +317373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -316469,7 +317445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -316570,7 +317550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -316759,15 +317739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -316879,7 +317859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -317095,8 +318075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -317130,8 +318110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -317201,7 +318181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -317693,7 +318673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -317765,7 +318745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -317866,7 +318850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -318055,15 +319039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -318175,7 +319159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -318391,8 +319375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -318426,8 +319410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -318497,7 +319481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -318989,7 +319973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -319061,7 +320045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -319162,7 +320150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -319351,15 +320339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -319471,7 +320459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -319687,8 +320675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -319722,8 +320710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -319793,7 +320781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -320285,7 +321273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -320357,7 +321345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -320458,7 +321450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -320647,15 +321639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -320767,7 +321759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -320983,8 +321975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -321018,8 +322010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -321089,7 +322081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -321581,7 +322573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -321653,7 +322645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -321754,7 +322750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -321943,15 +322939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -322063,7 +323059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -322279,8 +323275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -322314,8 +323310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -322385,7 +323381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -322877,7 +323873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -322949,7 +323945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -323050,7 +324050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -323239,15 +324239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -323359,7 +324359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -323575,8 +324575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -323610,8 +324610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -323681,7 +324681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -324173,7 +325173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -324245,7 +325245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -324346,7 +325350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -324535,15 +325539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -324655,7 +325659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -324871,8 +325875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -324906,8 +325910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -324977,7 +325981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -325469,7 +326473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -325541,7 +326545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -325642,7 +326650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -325831,15 +326839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -325951,7 +326959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -326167,8 +327175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -326202,8 +327210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -326273,7 +327281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -326765,7 +327773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -326837,7 +327845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -326938,7 +327950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -327127,15 +328139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -327247,7 +328259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -327463,8 +328475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -327498,8 +328510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -327569,7 +328581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -328061,7 +329073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -328133,7 +329145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -328234,7 +329250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -328423,15 +329439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -328543,7 +329559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -328759,8 +329775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -328794,8 +329810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -328865,7 +329881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -329357,7 +330373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -329429,7 +330445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -329530,7 +330550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -329719,15 +330739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -329839,7 +330859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -330055,8 +331075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -330090,8 +331110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -330161,7 +331181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -330653,7 +331673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -330725,7 +331745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -330826,7 +331850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -331015,15 +332039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -331135,7 +332159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -331351,8 +332375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -331386,8 +332410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -331457,7 +332481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -331949,7 +332973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -332021,7 +333045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -332122,7 +333150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -332311,15 +333339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -332431,7 +333459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -332647,8 +333675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -332682,8 +333710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -332753,7 +333781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -333245,7 +334273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -333317,7 +334345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -333418,7 +334450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -333607,15 +334639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -333727,7 +334759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -333943,8 +334975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -333978,8 +335010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -334049,7 +335081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -334541,7 +335573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -334613,7 +335645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -334714,7 +335750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -334903,15 +335939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -335023,7 +336059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -335239,8 +336275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -335274,8 +336310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -335345,7 +336381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -335837,7 +336873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -335909,7 +336945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -336010,7 +337050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -336199,15 +337239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -336319,7 +337359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -336535,8 +337575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -336570,8 +337610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -336641,7 +337681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -337133,7 +338173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -337205,7 +338245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -337306,7 +338350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -337495,15 +338539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -337615,7 +338659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -337831,8 +338875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -337866,8 +338910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -337937,7 +338981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -338429,7 +339473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -338501,7 +339545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -338602,7 +339650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -338791,15 +339839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -338911,7 +339959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -339127,8 +340175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -339162,8 +340210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -339233,7 +340281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -339725,7 +340773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -339797,7 +340845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -339898,7 +340950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -340087,15 +341139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -340207,7 +341259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -340423,8 +341475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -340458,8 +341510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -340529,7 +341581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -341021,7 +342073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -341093,7 +342145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -341194,7 +342250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -341383,15 +342439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -341503,7 +342559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -341719,8 +342775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -341754,8 +342810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -341825,7 +342881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -342317,7 +343373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -342389,7 +343445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -342490,7 +343550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -342679,15 +343739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -342799,7 +343859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -343015,8 +344075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -343050,8 +344110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -343121,7 +344181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -343613,7 +344673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -343685,7 +344745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -343786,7 +344850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -343975,15 +345039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -344095,7 +345159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -344311,8 +345375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -344346,8 +345410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -344417,7 +345481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -344909,7 +345973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -344981,7 +346045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -345082,7 +346150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -345271,15 +346339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -345391,7 +346459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -345607,8 +346675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -345642,8 +346710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -345713,7 +346781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -346205,7 +347273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -346277,7 +347345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -346378,7 +347450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -346567,15 +347639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -346687,7 +347759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -346903,8 +347975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -346938,8 +348010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -347009,7 +348081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -347501,7 +348573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -347573,7 +348645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -347674,7 +348750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -347863,15 +348939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -347983,7 +349059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -348199,8 +349275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -348234,8 +349310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -348305,7 +349381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -348797,7 +349873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -348869,7 +349945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -348970,7 +350050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -349159,15 +350239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -349279,7 +350359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -349495,8 +350575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -349530,8 +350610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -349601,7 +350681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -350093,7 +351173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -350165,7 +351245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -350266,7 +351350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -350455,15 +351539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -350575,7 +351659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -350791,8 +351875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -350826,8 +351910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -350897,7 +351981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -351389,7 +352473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -351461,7 +352545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -351562,7 +352650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -351751,15 +352839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -351871,7 +352959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -352087,8 +353175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -352122,8 +353210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -352193,7 +353281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -352685,7 +353773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -352757,7 +353845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -352858,7 +353950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -353047,15 +354139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -353167,7 +354259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -353383,8 +354475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -353418,8 +354510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -353489,7 +354581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -353981,7 +355073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -354053,7 +355145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -354154,7 +355250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -354343,15 +355439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -354463,7 +355559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -354679,8 +355775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -354714,8 +355810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -354785,7 +355881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -355277,7 +356373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -355349,7 +356445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -355450,7 +356550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -355639,15 +356739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -355759,7 +356859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -355975,8 +357075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -356010,8 +357110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -356081,7 +357181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -356573,7 +357673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -356645,7 +357745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -356746,7 +357850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -356935,15 +358039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -357055,7 +358159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -357271,8 +358375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -357306,8 +358410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -357377,7 +358481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -357869,7 +358973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -357941,7 +359045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -358042,7 +359150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -358231,15 +359339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -358351,7 +359459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -358567,8 +359675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -358602,8 +359710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -358673,7 +359781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -359165,7 +360273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -359237,7 +360345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -359338,7 +360450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -359527,15 +360639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -359647,7 +360759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -359863,8 +360975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -359898,8 +361010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -359969,7 +361081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -360461,7 +361573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -360533,7 +361645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -360634,7 +361750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -360823,15 +361939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -360943,7 +362059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -361159,8 +362275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -361194,8 +362310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -361265,7 +362381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -361757,7 +362873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -361829,7 +362945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -361930,7 +363050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -362119,15 +363239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -362239,7 +363359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -362455,8 +363575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -362490,8 +363610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -362561,7 +363681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -363053,7 +364173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -363125,7 +364245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -363226,7 +364350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -363415,15 +364539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -363535,7 +364659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -363751,8 +364875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -363786,8 +364910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -363857,7 +364981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -364349,7 +365473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -364421,7 +365545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -364522,7 +365650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -364711,15 +365839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -364831,7 +365959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -365047,8 +366175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -365082,8 +366210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -365153,7 +366281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -365645,7 +366773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -365717,7 +366845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -365818,7 +366950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -366007,15 +367139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -366127,7 +367259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -366343,8 +367475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -366378,8 +367510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -366449,7 +367581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -366941,7 +368073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -367013,7 +368145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -367114,7 +368250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -367303,15 +368439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -367423,7 +368559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -367639,8 +368775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -367674,8 +368810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -367745,7 +368881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -368237,7 +369373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -368309,7 +369445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -368410,7 +369550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -368599,15 +369739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -368719,7 +369859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -368935,8 +370075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -368970,8 +370110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -369041,7 +370181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -369533,7 +370673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -369605,7 +370745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -369706,7 +370850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -369895,15 +371039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -370015,7 +371159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -370231,8 +371375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -370266,8 +371410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -370337,7 +371481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -370829,7 +371973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -370901,7 +372045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -371002,7 +372150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -371191,15 +372339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -371311,7 +372459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -371527,8 +372675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -371562,8 +372710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -371633,7 +372781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -372125,7 +373273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -372197,7 +373345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -372298,7 +373450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -372487,15 +373639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -372607,7 +373759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -372823,8 +373975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -372858,8 +374010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -372929,7 +374081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -373421,7 +374573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -373493,7 +374645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -373594,7 +374750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -373783,15 +374939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -373903,7 +375059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -374119,8 +375275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -374154,8 +375310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -374225,7 +375381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -374717,7 +375873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -374789,7 +375945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -374890,7 +376050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -375079,15 +376239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -375199,7 +376359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -375415,8 +376575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -375450,8 +376610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -375521,7 +376681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -376013,7 +377173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -376085,7 +377245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -376186,7 +377350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -376375,15 +377539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -376495,7 +377659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -376711,8 +377875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -376746,8 +377910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -376817,7 +377981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -377309,7 +378473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -377381,7 +378545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -377482,7 +378650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -377671,15 +378839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -377791,7 +378959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -378007,8 +379175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -378042,8 +379210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -378113,7 +379281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -378605,7 +379773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -378677,7 +379845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -378778,7 +379950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -378967,15 +380139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -379087,7 +380259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -379303,8 +380475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -379338,8 +380510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -379409,7 +380581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -379901,7 +381073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -379973,7 +381145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -380074,7 +381250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -380263,15 +381439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -380383,7 +381559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -380599,8 +381775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -380634,8 +381810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -380705,7 +381881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -381197,7 +382373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -381269,7 +382445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -381370,7 +382550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -381559,15 +382739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -381679,7 +382859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -381895,8 +383075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -381930,8 +383110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -382001,7 +383181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -382493,7 +383673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -382565,7 +383745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -382666,7 +383850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -382855,15 +384039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -382975,7 +384159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -383191,8 +384375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -383226,8 +384410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -383297,7 +384481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -383789,7 +384973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -383861,7 +385045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -383962,7 +385150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -384151,15 +385339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -384271,7 +385459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -384487,8 +385675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -384522,8 +385710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -384593,7 +385781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -385085,7 +386273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -385157,7 +386345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -385258,7 +386450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -385447,15 +386639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -385567,7 +386759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -385783,8 +386975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -385818,8 +387010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -385889,7 +387081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -386381,7 +387573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -386453,7 +387645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -386554,7 +387750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -386743,15 +387939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -386863,7 +388059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -387079,8 +388275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -387114,8 +388310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -387185,7 +388381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -387677,7 +388873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -387749,7 +388945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -387850,7 +389050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -388039,15 +389239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -388159,7 +389359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -388375,8 +389575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -388410,8 +389610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -388481,7 +389681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -388973,7 +390173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -389045,7 +390245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -389146,7 +390350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -389335,15 +390539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -389455,7 +390659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -389671,8 +390875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -389706,8 +390910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -389777,7 +390981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -390269,7 +391473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -390341,7 +391545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -390442,7 +391650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -390631,15 +391839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -390751,7 +391959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -390967,8 +392175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -391002,8 +392210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -391073,7 +392281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -391565,7 +392773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -391637,7 +392845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -391738,7 +392950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -391927,15 +393139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -392047,7 +393259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -392263,8 +393475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -392298,8 +393510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -392369,7 +393581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -392861,7 +394073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -392933,7 +394145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -393034,7 +394250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -393223,15 +394439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -393343,7 +394559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -393559,8 +394775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -393594,8 +394810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -393665,7 +394881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -394157,7 +395373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -394229,7 +395445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -394330,7 +395550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -394519,15 +395739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -394639,7 +395859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -394855,8 +396075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -394890,8 +396110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -394961,7 +396181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -395453,7 +396673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -395525,7 +396745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -395626,7 +396850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -395815,15 +397039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -395935,7 +397159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -396151,8 +397375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -396186,8 +397410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -396257,7 +397481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -396749,7 +397973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -396821,7 +398045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -396922,7 +398150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -397111,15 +398339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -397231,7 +398459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -397447,8 +398675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -397482,8 +398710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -397553,7 +398781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -398045,7 +399273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -398117,7 +399345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -398218,7 +399450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -398407,15 +399639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -398527,7 +399759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -398743,8 +399975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -398778,8 +400010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -398849,7 +400081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -399341,7 +400573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -399413,7 +400645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -399514,7 +400750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -399703,15 +400939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -399823,7 +401059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -400039,8 +401275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -400074,8 +401310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -400145,7 +401381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -400637,7 +401873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -400709,7 +401945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -400810,7 +402050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -400999,15 +402239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -401119,7 +402359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -401335,8 +402575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -401370,8 +402610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -401441,7 +402681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -401933,7 +403173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -402005,7 +403245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -402106,7 +403350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -402295,15 +403539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -402415,7 +403659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -402631,8 +403875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -402666,8 +403910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -402737,7 +403981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -403229,7 +404473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -403301,7 +404545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -403402,7 +404650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -403591,15 +404839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -403711,7 +404959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -403927,8 +405175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -403962,8 +405210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -404033,7 +405281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -404525,7 +405773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -404597,7 +405845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -404698,7 +405950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -404887,15 +406139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -405007,7 +406259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -405223,8 +406475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -405258,8 +406510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -405329,7 +406581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -405821,7 +407073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -405893,7 +407145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -405994,7 +407250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -406183,15 +407439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -406303,7 +407559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -406519,8 +407775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -406554,8 +407810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -406625,7 +407881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -407117,7 +408373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -407189,7 +408445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -407290,7 +408550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -407479,15 +408739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -407599,7 +408859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -407815,8 +409075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -407850,8 +409110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -407921,7 +409181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -408413,7 +409673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -408485,7 +409745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -408586,7 +409850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -408775,15 +410039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -408895,7 +410159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -409111,8 +410375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -409146,8 +410410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -409217,7 +410481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -409709,7 +410973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -409781,7 +411045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -409882,7 +411150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -410071,15 +411339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -410191,7 +411459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -410407,8 +411675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -410442,8 +411710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -410513,7 +411781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -411005,7 +412273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -411077,7 +412345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -411178,7 +412450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -411367,15 +412639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -411487,7 +412759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -411703,8 +412975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -411738,8 +413010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -411809,7 +413081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -412301,7 +413573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -412373,7 +413645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -412474,7 +413750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -412663,15 +413939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -412783,7 +414059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -412999,8 +414275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -413034,8 +414310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -413105,7 +414381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -413597,7 +414873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -413669,7 +414945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -413770,7 +415050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -413959,15 +415239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -414079,7 +415359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -414295,8 +415575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -414330,8 +415610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -414401,7 +415681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -414893,7 +416173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -414965,7 +416245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -415066,7 +416350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -415255,15 +416539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -415375,7 +416659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -415591,8 +416875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -415626,8 +416910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -415697,7 +416981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -416189,7 +417473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -416261,7 +417545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -416362,7 +417650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -416551,15 +417839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -416671,7 +417959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -416887,8 +418175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -416922,8 +418210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -416993,7 +418281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -417485,7 +418773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -417557,7 +418845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -417658,7 +418950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -417847,15 +419139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -417967,7 +419259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -418183,8 +419475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -418218,8 +419510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -418289,7 +419581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -418781,7 +420073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -418853,7 +420145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -418954,7 +420250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -419143,15 +420439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -419263,7 +420559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -419479,8 +420775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -419514,8 +420810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -419585,7 +420881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -420077,7 +421373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -420149,7 +421445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -420250,7 +421550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -420439,15 +421739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -420559,7 +421859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -420775,8 +422075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -420810,8 +422110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -420881,7 +422181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -421373,7 +422673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -421445,7 +422745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -421546,7 +422850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -421735,15 +423039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -421855,7 +423159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -422071,8 +423375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -422106,8 +423410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -422177,7 +423481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -422669,7 +423973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -422741,7 +424045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -422842,7 +424150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -423031,15 +424339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -423151,7 +424459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -423367,8 +424675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -423402,8 +424710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -423473,7 +424781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -423965,7 +425273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -424037,7 +425345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -424138,7 +425450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -424327,15 +425639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -424447,7 +425759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -424663,8 +425975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -424698,8 +426010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -424769,7 +426081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -425261,7 +426573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -425333,7 +426645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -425434,7 +426750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -425623,15 +426939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -425743,7 +427059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -425959,8 +427275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -425994,8 +427310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -426065,7 +427381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -426557,7 +427873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -426629,7 +427945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -426730,7 +428050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -426919,15 +428239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -427039,7 +428359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -427255,8 +428575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -427290,8 +428610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -427361,7 +428681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -427853,7 +429173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -427925,7 +429245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -428026,7 +429350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -428215,15 +429539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -428335,7 +429659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -428551,8 +429875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -428586,8 +429910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -428657,7 +429981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -429149,7 +430473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -429221,7 +430545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -429322,7 +430650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -429511,15 +430839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -429631,7 +430959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -429847,8 +431175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -429882,8 +431210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -429953,7 +431281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -430445,7 +431773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -430517,7 +431845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -430618,7 +431950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -430807,15 +432139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -430927,7 +432259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -431143,8 +432475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -431178,8 +432510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -431249,7 +432581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -431741,7 +433073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -431813,7 +433145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -431914,7 +433250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -432103,15 +433439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -432223,7 +433559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -432439,8 +433775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -432474,8 +433810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -432545,7 +433881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -433037,7 +434373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -433109,7 +434445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -433210,7 +434550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -433399,15 +434739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -433519,7 +434859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -433735,8 +435075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -433770,8 +435110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -433841,7 +435181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -434333,7 +435673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -434405,7 +435745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -434506,7 +435850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -434695,15 +436039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -434815,7 +436159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -435031,8 +436375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -435066,8 +436410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -435137,7 +436481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -435629,7 +436973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -435701,7 +437045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -435802,7 +437150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -435991,15 +437339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -436111,7 +437459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -436327,8 +437675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -436362,8 +437710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -436433,7 +437781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -436925,7 +438273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -436997,7 +438345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -437098,7 +438450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -437287,15 +438639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -437407,7 +438759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -437623,8 +438975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -437658,8 +439010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -437729,7 +439081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -438221,7 +439573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -438293,7 +439645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -438394,7 +439750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -438583,15 +439939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -438703,7 +440059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -438919,8 +440275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -438954,8 +440310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -439025,7 +440381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -439517,7 +440873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -439589,7 +440945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -439690,7 +441050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -439879,15 +441239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -439999,7 +441359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -440215,8 +441575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -440250,8 +441610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -440321,7 +441681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -440813,7 +442173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -440885,7 +442245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -440986,7 +442350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -441175,15 +442539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -441295,7 +442659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -441511,8 +442875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -441546,8 +442910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -441617,7 +442981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -442109,7 +443473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -442181,7 +443545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -442282,7 +443650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -442471,15 +443839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -442591,7 +443959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -442807,8 +444175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -442842,8 +444210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -442913,7 +444281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -443405,7 +444773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -443477,7 +444845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -443578,7 +444950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -443767,15 +445139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -443887,7 +445259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -444103,8 +445475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -444138,8 +445510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -444209,7 +445581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -444701,7 +446073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -444773,7 +446145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -444874,7 +446250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -445063,15 +446439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -445183,7 +446559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -445399,8 +446775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -445434,8 +446810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -445505,7 +446881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -445997,7 +447373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -446069,7 +447445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -446170,7 +447550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -446359,15 +447739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -446479,7 +447859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -446695,8 +448075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -446730,8 +448110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -446801,7 +448181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -447293,7 +448673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -447365,7 +448745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -447466,7 +448850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -447655,15 +449039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -447775,7 +449159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -447991,8 +449375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -448026,8 +449410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -448097,7 +449481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -448589,7 +449973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -448661,7 +450045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -448762,7 +450150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -448951,15 +450339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -449071,7 +450459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -449287,8 +450675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -449322,8 +450710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -449393,7 +450781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -449885,7 +451273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -449957,7 +451345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -450058,7 +451450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -450247,15 +451639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -450367,7 +451759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -450583,8 +451975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -450618,8 +452010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -450689,7 +452081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -451181,7 +452573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -451253,7 +452645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -451354,7 +452750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -451543,15 +452939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -451663,7 +453059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -451879,8 +453275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -451914,8 +453310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -451985,7 +453381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -452477,7 +453873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -452549,7 +453945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -452650,7 +454050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -452839,15 +454239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -452959,7 +454359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -453175,8 +454575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -453210,8 +454610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -453281,7 +454681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -453773,7 +455173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -453845,7 +455245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -453946,7 +455350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -454135,15 +455539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -454255,7 +455659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -454471,8 +455875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -454506,8 +455910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -454577,7 +455981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -455069,7 +456473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -455141,7 +456545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -455242,7 +456650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -455431,15 +456839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -455551,7 +456959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -455767,8 +457175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -455802,8 +457210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -455873,7 +457281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -456365,7 +457773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -456437,7 +457845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -456538,7 +457950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -456727,15 +458139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -456847,7 +458259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -457063,8 +458475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -457098,8 +458510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -457169,7 +458581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -457661,7 +459073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -457733,7 +459145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -457834,7 +459250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -458023,15 +459439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -458143,7 +459559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -458359,8 +459775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -458394,8 +459810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -458465,7 +459881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -458957,7 +460373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -459029,7 +460445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -459130,7 +460550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -459319,15 +460739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -459439,7 +460859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -459655,8 +461075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -459690,8 +461110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -459761,7 +461181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -460253,7 +461673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -460325,7 +461745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -460426,7 +461850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -460615,15 +462039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -460735,7 +462159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -460951,8 +462375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -460986,8 +462410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -461057,7 +462481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -461549,7 +462973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -461621,7 +463045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -461722,7 +463150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -461911,15 +463339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -462031,7 +463459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -462247,8 +463675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -462282,8 +463710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -462353,7 +463781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -462845,7 +464273,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -462917,7 +464345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -463018,7 +464450,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -463207,15 +464639,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -463327,7 +464759,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -463543,8 +464975,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -463578,8 +465010,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -463649,7 +465081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -464141,7 +465573,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -464213,7 +465645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -464314,7 +465750,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -464503,15 +465939,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -464623,7 +466059,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -464839,8 +466275,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -464874,8 +466310,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -464945,7 +466381,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -465437,7 +466873,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -465509,7 +466945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -465610,7 +467050,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -465799,15 +467239,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -465919,7 +467359,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -466135,8 +467575,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -466170,8 +467610,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -466241,7 +467681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -466733,7 +468173,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -466805,7 +468245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -466906,7 +468350,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -467095,15 +468539,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -467215,7 +468659,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -467431,8 +468875,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -467466,8 +468910,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -467537,7 +468981,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -468029,7 +469473,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -468101,7 +469545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -468202,7 +469650,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -468391,15 +469839,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -468511,7 +469959,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -468727,8 +470175,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -468762,8 +470210,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -468833,7 +470281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -469325,7 +470773,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -469397,7 +470845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -469498,7 +470950,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -469687,15 +471139,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -469807,7 +471259,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -470023,8 +471475,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -470058,8 +471510,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -470129,7 +471581,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -470621,7 +472073,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -470693,7 +472145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -470794,7 +472250,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -470983,15 +472439,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -471103,7 +472559,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -471319,8 +472775,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -471354,8 +472810,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -471425,7 +472881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -471917,7 +473373,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -471989,7 +473445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -472090,7 +473550,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -472279,15 +473739,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -472399,7 +473859,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -472615,8 +474075,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -472650,8 +474110,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -472721,7 +474181,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -473213,7 +474673,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -473285,7 +474745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -473386,7 +474850,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -473575,15 +475039,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -473695,7 +475159,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -473911,8 +475375,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -473946,8 +475410,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -474017,7 +475481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -474509,7 +475973,7 @@
         {},
         {
             "techniqueID": "T1547",
-            "score": 6,
+            "score": 12,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml"
         },
         {},
@@ -474581,7 +476045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1547.012",
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml"
+        },
         {},
         {},
         {
@@ -474682,7 +476150,7 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 25,
+            "score": 26,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml"
         },
         {},
@@ -474871,15 +476339,15 @@
         {},
         {
             "techniqueID": "T1070.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {},
         {},
         {
             "techniqueID": "T1222",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_cacls_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_deny_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icacls_grant_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/permission_modification_using_takeown_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml"
         },
         {
             "techniqueID": "T1003.001",
@@ -474991,7 +476459,7 @@
         {},
         {
             "techniqueID": "T1070",
-            "score": 8,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
         },
         {},
@@ -475207,8 +476675,8 @@
         {},
         {
             "techniqueID": "T1562.001",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -475242,8 +476710,8 @@
         {},
         {
             "techniqueID": "T1068",
-            "score": 9,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1531",
@@ -475313,7 +476781,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
diff --git a/docs/mitre-map/detections.csv b/docs/mitre-map/detections.csv
index fbd1a7c85d..7032f04db1 100644
--- a/docs/mitre-map/detections.csv
+++ b/docs/mitre-map/detections.csv
@@ -81476,8076 +81476,8443 @@ T1584.001,No,-,15
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1059.007,No,-,14
 T1045,No,-,14
 T1036.004,No,-,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-4
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-4
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml,-5
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml,-5
 T1027.002,No,-,14
 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
@@ -91392,15 +91759,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91416,15 +91784,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91440,15 +91809,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91464,15 +91834,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91488,15 +91859,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91512,15 +91884,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91536,15 +91909,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91560,15 +91934,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91584,15 +91959,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91608,15 +91984,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91632,15 +92009,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91656,15 +92034,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91680,15 +92059,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91704,15 +92084,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91728,15 +92109,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91752,15 +92134,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91776,15 +92159,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91800,15 +92184,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91824,15 +92209,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91848,15 +92234,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91872,15 +92259,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91896,15 +92284,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91920,15 +92309,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91944,15 +92334,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91968,15 +92359,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -91992,15 +92384,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92016,15 +92409,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92040,15 +92434,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92064,15 +92459,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92088,15 +92484,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92112,15 +92509,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92136,15 +92534,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92160,15 +92559,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92184,15 +92584,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92208,15 +92609,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92232,15 +92634,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92256,15 +92659,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92280,15 +92684,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92304,15 +92709,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92328,15 +92734,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92352,15 +92759,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92376,15 +92784,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92400,15 +92809,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92424,15 +92834,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92448,15 +92859,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92472,15 +92884,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92496,15 +92909,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92520,15 +92934,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92544,15 +92959,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92568,15 +92984,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92592,15 +93009,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92616,15 +93034,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92640,15 +93059,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92664,15 +93084,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92688,15 +93109,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92712,15 +93134,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92736,15 +93159,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92760,15 +93184,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92784,15 +93209,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92808,15 +93234,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92832,15 +93259,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92856,15 +93284,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92880,15 +93309,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92904,15 +93334,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92928,15 +93359,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92952,15 +93384,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -92976,15 +93409,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93000,15 +93434,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93024,15 +93459,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93048,15 +93484,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93072,15 +93509,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93096,15 +93534,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93120,15 +93559,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93144,15 +93584,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93168,15 +93609,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93192,15 +93634,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93216,15 +93659,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93240,15 +93684,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93264,15 +93709,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93288,15 +93734,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93312,15 +93759,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93336,15 +93784,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93360,15 +93809,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93384,15 +93834,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93408,15 +93859,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93432,15 +93884,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93456,15 +93909,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93480,15 +93934,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93504,15 +93959,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93528,15 +93984,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93552,15 +94009,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93576,15 +94034,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93600,15 +94059,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93624,15 +94084,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93648,15 +94109,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93672,15 +94134,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93696,15 +94159,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93720,15 +94184,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93744,15 +94209,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93768,15 +94234,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93792,15 +94259,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93816,15 +94284,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93840,15 +94309,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93864,15 +94334,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93888,15 +94359,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93912,15 +94384,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93936,15 +94409,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93960,15 +94434,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -93984,15 +94459,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94008,15 +94484,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94032,15 +94509,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94056,15 +94534,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94080,15 +94559,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94104,15 +94584,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94128,15 +94609,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94152,15 +94634,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94176,15 +94659,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94200,15 +94684,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94224,15 +94709,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94248,15 +94734,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94272,15 +94759,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94296,15 +94784,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94320,15 +94809,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94344,15 +94834,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94368,15 +94859,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94392,15 +94884,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94416,15 +94909,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94440,15 +94934,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94464,15 +94959,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94488,15 +94984,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94512,15 +95009,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94536,15 +95034,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94560,15 +95059,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94584,15 +95084,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94608,15 +95109,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94632,15 +95134,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94656,15 +95159,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94680,15 +95184,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94704,15 +95209,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94728,15 +95234,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94752,15 +95259,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94776,15 +95284,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94800,15 +95309,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94824,15 +95334,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94848,15 +95359,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94872,15 +95384,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94896,15 +95409,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94920,15 +95434,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94944,15 +95459,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94968,15 +95484,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -94992,15 +95509,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95016,15 +95534,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95040,15 +95559,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95064,15 +95584,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95088,15 +95609,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95112,15 +95634,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95136,15 +95659,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95160,15 +95684,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95184,15 +95709,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95208,15 +95734,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95232,15 +95759,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95256,15 +95784,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95280,15 +95809,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95304,15 +95834,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95328,15 +95859,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95352,15 +95884,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95376,15 +95909,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95400,15 +95934,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95424,15 +95959,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95448,15 +95984,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95472,15 +96009,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95496,15 +96034,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95520,15 +96059,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95544,15 +96084,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95568,15 +96109,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95592,15 +96134,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95616,15 +96159,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95640,15 +96184,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95664,15 +96209,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95688,15 +96234,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95712,15 +96259,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95736,15 +96284,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95760,15 +96309,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95784,15 +96334,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95808,15 +96359,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95832,15 +96384,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95856,15 +96409,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95880,15 +96434,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95904,15 +96459,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95928,15 +96484,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95952,15 +96509,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -95976,15 +96534,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96000,15 +96559,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96024,15 +96584,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96048,15 +96609,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96072,15 +96634,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96096,15 +96659,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96120,15 +96684,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96144,15 +96709,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96168,15 +96734,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96192,15 +96759,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96216,15 +96784,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96240,15 +96809,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96264,15 +96834,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96288,15 +96859,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96312,15 +96884,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96336,15 +96909,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96360,15 +96934,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96384,15 +96959,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96408,15 +96984,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96432,15 +97009,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96456,15 +97034,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96480,15 +97059,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96504,15 +97084,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96528,15 +97109,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96552,15 +97134,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96576,15 +97159,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96600,15 +97184,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96624,15 +97209,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96648,15 +97234,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96672,15 +97259,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96696,15 +97284,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96720,15 +97309,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96744,15 +97334,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96768,15 +97359,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96792,15 +97384,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96816,15 +97409,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96840,15 +97434,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96864,15 +97459,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96888,15 +97484,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96912,15 +97509,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96936,15 +97534,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96960,15 +97559,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -96984,15 +97584,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97008,15 +97609,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97032,15 +97634,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97056,15 +97659,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97080,15 +97684,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97104,15 +97709,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97128,15 +97734,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97152,15 +97759,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97176,15 +97784,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97200,15 +97809,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97224,15 +97834,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97248,15 +97859,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97272,15 +97884,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97296,15 +97909,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97320,15 +97934,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97344,15 +97959,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97368,15 +97984,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97392,15 +98009,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97416,15 +98034,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97440,15 +98059,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97464,15 +98084,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97488,15 +98109,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97512,15 +98134,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97536,15 +98159,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97560,15 +98184,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97584,15 +98209,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97608,15 +98234,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97632,15 +98259,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97656,15 +98284,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97680,15 +98309,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97704,15 +98334,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97728,15 +98359,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97752,15 +98384,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97776,15 +98409,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97800,15 +98434,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97824,15 +98459,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97848,15 +98484,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97872,15 +98509,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97896,15 +98534,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97920,15 +98559,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97944,15 +98584,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97968,15 +98609,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -97992,15 +98634,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98016,15 +98659,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98040,15 +98684,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98064,15 +98709,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98088,15 +98734,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98112,15 +98759,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98136,15 +98784,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98160,15 +98809,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98184,15 +98834,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98208,15 +98859,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98232,15 +98884,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98256,15 +98909,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98280,15 +98934,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98304,15 +98959,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98328,15 +98984,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98352,15 +99009,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98376,15 +99034,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98400,15 +99059,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98424,15 +99084,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98448,15 +99109,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98472,15 +99134,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98496,15 +99159,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98520,15 +99184,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98544,15 +99209,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98568,15 +99234,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98592,15 +99259,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98616,15 +99284,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98640,15 +99309,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98664,15 +99334,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98688,15 +99359,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98712,15 +99384,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98736,15 +99409,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98760,15 +99434,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98784,15 +99459,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98808,15 +99484,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98832,15 +99509,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98856,15 +99534,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98880,15 +99559,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98904,15 +99584,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98928,15 +99609,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98952,15 +99634,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -98976,15 +99659,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99000,15 +99684,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99024,15 +99709,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99048,15 +99734,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99072,15 +99759,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99096,15 +99784,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99120,15 +99809,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99144,15 +99834,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99168,15 +99859,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99192,15 +99884,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99216,15 +99909,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99240,15 +99934,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99264,15 +99959,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99288,15 +99984,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99312,15 +100009,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99336,15 +100034,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99360,15 +100059,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99384,15 +100084,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99408,15 +100109,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99432,15 +100134,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99456,15 +100159,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99480,15 +100184,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99504,15 +100209,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99528,15 +100234,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99552,15 +100259,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99576,15 +100284,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99600,15 +100309,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99624,15 +100334,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99648,15 +100359,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99672,15 +100384,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99696,15 +100409,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99720,15 +100434,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99744,15 +100459,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99768,15 +100484,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99792,15 +100509,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99816,15 +100534,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99840,15 +100559,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99864,15 +100584,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99888,15 +100609,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99912,15 +100634,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99936,15 +100659,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99960,15 +100684,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -99984,15 +100709,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -100008,15 +100734,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -100032,15 +100759,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -100056,15 +100784,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -100080,15 +100809,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -100104,15 +100834,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -100128,15 +100859,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -100152,15 +100884,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -100176,15 +100909,16 @@ T1090,No,-,11
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml,9
 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml,9
 T1571,No,-,11
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
-T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,1
+T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,1
 T1059.006,No,-,11
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
 T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
@@ -104239,10 +104973,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104271,10 +105007,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104303,10 +105041,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104335,10 +105075,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104367,10 +105109,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104399,10 +105143,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104431,10 +105177,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104463,10 +105211,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104495,10 +105245,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104527,10 +105279,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104559,10 +105313,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104591,10 +105347,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104623,10 +105381,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104655,10 +105415,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104687,10 +105449,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104719,10 +105483,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104751,10 +105517,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104783,10 +105551,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104815,10 +105585,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104847,10 +105619,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104879,10 +105653,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104911,10 +105687,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104943,10 +105721,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -104975,10 +105755,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105007,10 +105789,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105039,10 +105823,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105071,10 +105857,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105103,10 +105891,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105135,10 +105925,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105167,10 +105959,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105199,10 +105993,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105231,10 +106027,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105263,10 +106061,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105295,10 +106095,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105327,10 +106129,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105359,10 +106163,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105391,10 +106197,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105423,10 +106231,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105455,10 +106265,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105487,10 +106299,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105519,10 +106333,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105551,10 +106367,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105583,10 +106401,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105615,10 +106435,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105647,10 +106469,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105679,10 +106503,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105711,10 +106537,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105743,10 +106571,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105775,10 +106605,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105807,10 +106639,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105839,10 +106673,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105871,10 +106707,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105903,10 +106741,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105935,10 +106775,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105967,10 +106809,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -105999,10 +106843,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106031,10 +106877,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106063,10 +106911,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106095,10 +106945,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106127,10 +106979,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106159,10 +107013,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106191,10 +107047,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106223,10 +107081,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106255,10 +107115,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106287,10 +107149,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106319,10 +107183,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106351,10 +107217,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106383,10 +107251,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106415,10 +107285,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106447,10 +107319,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106479,10 +107353,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106511,10 +107387,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106543,10 +107421,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106575,10 +107455,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106607,10 +107489,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106639,10 +107523,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106671,10 +107557,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106703,10 +107591,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106735,10 +107625,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106767,10 +107659,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106799,10 +107693,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106831,10 +107727,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106863,10 +107761,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106895,10 +107795,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106927,10 +107829,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106959,10 +107863,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -106991,10 +107897,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107023,10 +107931,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107055,10 +107965,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107087,10 +107999,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107119,10 +108033,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107151,10 +108067,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107183,10 +108101,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107215,10 +108135,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107247,10 +108169,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107279,10 +108203,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107311,10 +108237,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107343,10 +108271,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107375,10 +108305,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107407,10 +108339,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107439,10 +108373,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107471,10 +108407,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107503,10 +108441,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107535,10 +108475,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107567,10 +108509,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107599,10 +108543,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107631,10 +108577,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107663,10 +108611,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107695,10 +108645,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107727,10 +108679,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107759,10 +108713,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107791,10 +108747,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107823,10 +108781,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107855,10 +108815,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107887,10 +108849,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107919,10 +108883,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107951,10 +108917,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -107983,10 +108951,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108015,10 +108985,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108047,10 +109019,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108079,10 +109053,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108111,10 +109087,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108143,10 +109121,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108175,10 +109155,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108207,10 +109189,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108239,10 +109223,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108271,10 +109257,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108303,10 +109291,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108335,10 +109325,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108367,10 +109359,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108399,10 +109393,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108431,10 +109427,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108463,10 +109461,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108495,10 +109495,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108527,10 +109529,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108559,10 +109563,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108591,10 +109597,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108623,10 +109631,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108655,10 +109665,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108687,10 +109699,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108719,10 +109733,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108751,10 +109767,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108783,10 +109801,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108815,10 +109835,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108847,10 +109869,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108879,10 +109903,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108911,10 +109937,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108943,10 +109971,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -108975,10 +110005,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109007,10 +110039,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109039,10 +110073,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109071,10 +110107,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109103,10 +110141,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109135,10 +110175,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109167,10 +110209,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109199,10 +110243,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109231,10 +110277,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109263,10 +110311,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109295,10 +110345,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109327,10 +110379,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109359,10 +110413,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109391,10 +110447,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109423,10 +110481,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109455,10 +110515,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109487,10 +110549,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109519,10 +110583,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109551,10 +110617,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109583,10 +110651,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109615,10 +110685,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109647,10 +110719,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109679,10 +110753,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109711,10 +110787,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109743,10 +110821,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109775,10 +110855,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109807,10 +110889,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109839,10 +110923,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109871,10 +110957,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109903,10 +110991,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109935,10 +111025,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109967,10 +111059,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -109999,10 +111093,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110031,10 +111127,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110063,10 +111161,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110095,10 +111195,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110127,10 +111229,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110159,10 +111263,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110191,10 +111297,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110223,10 +111331,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110255,10 +111365,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110287,10 +111399,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110319,10 +111433,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110351,10 +111467,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110383,10 +111501,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110415,10 +111535,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110447,10 +111569,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110479,10 +111603,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110511,10 +111637,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110543,10 +111671,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110575,10 +111705,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110607,10 +111739,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110639,10 +111773,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110671,10 +111807,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110703,10 +111841,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110735,10 +111875,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110767,10 +111909,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110799,10 +111943,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110831,10 +111977,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110863,10 +112011,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110895,10 +112045,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110927,10 +112079,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110959,10 +112113,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -110991,10 +112147,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111023,10 +112181,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111055,10 +112215,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111087,10 +112249,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111119,10 +112283,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111151,10 +112317,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111183,10 +112351,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111215,10 +112385,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111247,10 +112419,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111279,10 +112453,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111311,10 +112487,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111343,10 +112521,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111375,10 +112555,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111407,10 +112589,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111439,10 +112623,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111471,10 +112657,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111503,10 +112691,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111535,10 +112725,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111567,10 +112759,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111599,10 +112793,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111631,10 +112827,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111663,10 +112861,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111695,10 +112895,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111727,10 +112929,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111759,10 +112963,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111791,10 +112997,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111823,10 +113031,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111855,10 +113065,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111887,10 +113099,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111919,10 +113133,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111951,10 +113167,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -111983,10 +113201,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112015,10 +113235,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112047,10 +113269,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112079,10 +113303,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112111,10 +113337,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112143,10 +113371,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112175,10 +113405,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112207,10 +113439,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112239,10 +113473,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112271,10 +113507,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112303,10 +113541,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112335,10 +113575,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112367,10 +113609,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112399,10 +113643,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112431,10 +113677,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112463,10 +113711,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112495,10 +113745,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112527,10 +113779,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112559,10 +113813,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112591,10 +113847,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112623,10 +113881,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112655,10 +113915,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112687,10 +113949,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112719,10 +113983,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112751,10 +114017,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112783,10 +114051,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112815,10 +114085,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112847,10 +114119,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112879,10 +114153,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112911,10 +114187,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112943,10 +114221,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -112975,10 +114255,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113007,10 +114289,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113039,10 +114323,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113071,10 +114357,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113103,10 +114391,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113135,10 +114425,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113167,10 +114459,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113199,10 +114493,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113231,10 +114527,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113263,10 +114561,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113295,10 +114595,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113327,10 +114629,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113359,10 +114663,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113391,10 +114697,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113423,10 +114731,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113455,10 +114765,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113487,10 +114799,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113519,10 +114833,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113551,10 +114867,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113583,10 +114901,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113615,10 +114935,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113647,10 +114969,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113679,10 +115003,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113711,10 +115037,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113743,10 +115071,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113775,10 +115105,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113807,10 +115139,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113839,10 +115173,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113871,10 +115207,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113903,10 +115241,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113935,10 +115275,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113967,10 +115309,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -113999,10 +115343,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114031,10 +115377,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114063,10 +115411,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114095,10 +115445,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114127,10 +115479,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114159,10 +115513,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114191,10 +115547,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114223,10 +115581,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114255,10 +115615,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114287,10 +115649,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114319,10 +115683,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114351,10 +115717,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114383,10 +115751,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114415,10 +115785,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114447,10 +115819,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114479,10 +115853,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114511,10 +115887,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114543,10 +115921,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114575,10 +115955,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114607,10 +115989,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114639,10 +116023,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114671,10 +116057,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114703,10 +116091,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114735,10 +116125,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114767,10 +116159,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114799,10 +116193,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114831,10 +116227,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114863,10 +116261,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114895,10 +116295,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114927,10 +116329,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114959,10 +116363,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -114991,10 +116397,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115023,10 +116431,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115055,10 +116465,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115087,10 +116499,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115119,10 +116533,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115151,10 +116567,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115183,10 +116601,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115215,10 +116635,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115247,10 +116669,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115279,10 +116703,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115311,10 +116737,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115343,10 +116771,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115375,10 +116805,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115407,10 +116839,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115439,10 +116873,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115471,10 +116907,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115503,10 +116941,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115535,10 +116975,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115567,10 +117009,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115599,10 +117043,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115631,10 +117077,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115663,10 +117111,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115695,10 +117145,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115727,10 +117179,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115759,10 +117213,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115791,10 +117247,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115823,10 +117281,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115855,10 +117315,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115887,10 +117349,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115919,10 +117383,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -115951,10 +117417,12 @@ T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
 T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
 T1070.006,No,-,9
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,5
-T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,5
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml,3
+T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
 T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
@@ -182435,8 +183903,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -182489,8 +183957,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -182543,8 +184011,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -182597,8 +184065,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -182651,8 +184119,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -182705,8 +184173,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -182759,8 +184227,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -182813,8 +184281,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -182867,8 +184335,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -182921,8 +184389,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -182975,8 +184443,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183029,8 +184497,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183083,8 +184551,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183137,8 +184605,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183191,8 +184659,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183245,8 +184713,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183299,8 +184767,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183353,8 +184821,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183407,8 +184875,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183461,8 +184929,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183515,8 +184983,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183569,8 +185037,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183623,8 +185091,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183677,8 +185145,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183731,8 +185199,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183785,8 +185253,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183839,8 +185307,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183893,8 +185361,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -183947,8 +185415,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184001,8 +185469,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184055,8 +185523,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184109,8 +185577,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184163,8 +185631,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184217,8 +185685,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184271,8 +185739,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184325,8 +185793,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184379,8 +185847,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184433,8 +185901,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184487,8 +185955,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184541,8 +186009,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184595,8 +186063,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184649,8 +186117,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184703,8 +186171,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184757,8 +186225,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184811,8 +186279,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184865,8 +186333,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184919,8 +186387,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -184973,8 +186441,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185027,8 +186495,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185081,8 +186549,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185135,8 +186603,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185189,8 +186657,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185243,8 +186711,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185297,8 +186765,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185351,8 +186819,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185405,8 +186873,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185459,8 +186927,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185513,8 +186981,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185567,8 +187035,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185621,8 +187089,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185675,8 +187143,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185729,8 +187197,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185783,8 +187251,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185837,8 +187305,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185891,8 +187359,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185945,8 +187413,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -185999,8 +187467,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186053,8 +187521,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186107,8 +187575,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186161,8 +187629,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186215,8 +187683,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186269,8 +187737,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186323,8 +187791,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186377,8 +187845,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186431,8 +187899,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186485,8 +187953,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186539,8 +188007,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186593,8 +188061,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186647,8 +188115,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186701,8 +188169,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186755,8 +188223,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186809,8 +188277,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186863,8 +188331,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186917,8 +188385,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -186971,8 +188439,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187025,8 +188493,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187079,8 +188547,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187133,8 +188601,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187187,8 +188655,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187241,8 +188709,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187295,8 +188763,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187349,8 +188817,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187403,8 +188871,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187457,8 +188925,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187511,8 +188979,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187565,8 +189033,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187619,8 +189087,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187673,8 +189141,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187727,8 +189195,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187781,8 +189249,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187835,8 +189303,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187889,8 +189357,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187943,8 +189411,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -187997,8 +189465,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188051,8 +189519,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188105,8 +189573,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188159,8 +189627,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188213,8 +189681,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188267,8 +189735,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188321,8 +189789,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188375,8 +189843,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188429,8 +189897,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188483,8 +189951,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188537,8 +190005,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188591,8 +190059,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188645,8 +190113,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188699,8 +190167,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188753,8 +190221,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188807,8 +190275,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188861,8 +190329,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188915,8 +190383,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -188969,8 +190437,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189023,8 +190491,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189077,8 +190545,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189131,8 +190599,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189185,8 +190653,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189239,8 +190707,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189293,8 +190761,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189347,8 +190815,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189401,8 +190869,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189455,8 +190923,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189509,8 +190977,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189563,8 +191031,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189617,8 +191085,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189671,8 +191139,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189725,8 +191193,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189779,8 +191247,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189833,8 +191301,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189887,8 +191355,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189941,8 +191409,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -189995,8 +191463,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190049,8 +191517,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190103,8 +191571,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190157,8 +191625,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190211,8 +191679,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190265,8 +191733,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190319,8 +191787,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190373,8 +191841,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190427,8 +191895,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190481,8 +191949,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190535,8 +192003,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190589,8 +192057,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190643,8 +192111,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190697,8 +192165,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190751,8 +192219,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190805,8 +192273,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190859,8 +192327,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190913,8 +192381,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -190967,8 +192435,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191021,8 +192489,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191075,8 +192543,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191129,8 +192597,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191183,8 +192651,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191237,8 +192705,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191291,8 +192759,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191345,8 +192813,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191399,8 +192867,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191453,8 +192921,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191507,8 +192975,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191561,8 +193029,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191615,8 +193083,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191669,8 +193137,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191723,8 +193191,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191777,8 +193245,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191831,8 +193299,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191885,8 +193353,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191939,8 +193407,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -191993,8 +193461,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192047,8 +193515,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192101,8 +193569,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192155,8 +193623,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192209,8 +193677,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192263,8 +193731,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192317,8 +193785,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192371,8 +193839,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192425,8 +193893,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192479,8 +193947,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192533,8 +194001,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192587,8 +194055,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192641,8 +194109,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192695,8 +194163,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192749,8 +194217,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192803,8 +194271,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192857,8 +194325,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192911,8 +194379,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -192965,8 +194433,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193019,8 +194487,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193073,8 +194541,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193127,8 +194595,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193181,8 +194649,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193235,8 +194703,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193289,8 +194757,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193343,8 +194811,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193397,8 +194865,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193451,8 +194919,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193505,8 +194973,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193559,8 +195027,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193613,8 +195081,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193667,8 +195135,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193721,8 +195189,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193775,8 +195243,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193829,8 +195297,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193883,8 +195351,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193937,8 +195405,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -193991,8 +195459,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194045,8 +195513,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194099,8 +195567,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194153,8 +195621,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194207,8 +195675,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194261,8 +195729,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194315,8 +195783,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194369,8 +195837,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194423,8 +195891,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194477,8 +195945,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194531,8 +195999,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194585,8 +196053,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194639,8 +196107,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194693,8 +196161,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194747,8 +196215,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194801,8 +196269,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194855,8 +196323,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194909,8 +196377,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -194963,8 +196431,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195017,8 +196485,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195071,8 +196539,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195125,8 +196593,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195179,8 +196647,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195233,8 +196701,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195287,8 +196755,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195341,8 +196809,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195395,8 +196863,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195449,8 +196917,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195503,8 +196971,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195557,8 +197025,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195611,8 +197079,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195665,8 +197133,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195719,8 +197187,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195773,8 +197241,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195827,8 +197295,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195881,8 +197349,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195935,8 +197403,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -195989,8 +197457,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196043,8 +197511,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196097,8 +197565,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196151,8 +197619,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196205,8 +197673,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196259,8 +197727,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196313,8 +197781,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196367,8 +197835,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196421,8 +197889,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196475,8 +197943,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196529,8 +197997,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196583,8 +198051,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196637,8 +198105,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196691,8 +198159,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196745,8 +198213,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196799,8 +198267,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196853,8 +198321,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196907,8 +198375,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -196961,8 +198429,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197015,8 +198483,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197069,8 +198537,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197123,8 +198591,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197177,8 +198645,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197231,8 +198699,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197285,8 +198753,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197339,8 +198807,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197393,8 +198861,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197447,8 +198915,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197501,8 +198969,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197555,8 +199023,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197609,8 +199077,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197663,8 +199131,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197717,8 +199185,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197771,8 +199239,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197825,8 +199293,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197879,8 +199347,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197933,8 +199401,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -197987,8 +199455,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198041,8 +199509,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198095,8 +199563,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198149,8 +199617,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198203,8 +199671,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198257,8 +199725,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198311,8 +199779,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198365,8 +199833,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198419,8 +199887,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198473,8 +199941,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198527,8 +199995,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198581,8 +200049,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198635,8 +200103,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198689,8 +200157,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198743,8 +200211,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198797,8 +200265,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198851,8 +200319,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198905,8 +200373,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -198959,8 +200427,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199013,8 +200481,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199067,8 +200535,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199121,8 +200589,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199175,8 +200643,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199229,8 +200697,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199283,8 +200751,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199337,8 +200805,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199391,8 +200859,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199445,8 +200913,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199499,8 +200967,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199553,8 +201021,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199607,8 +201075,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199661,8 +201129,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199715,8 +201183,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199769,8 +201237,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199823,8 +201291,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199877,8 +201345,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199931,8 +201399,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -199985,8 +201453,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200039,8 +201507,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200093,8 +201561,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200147,8 +201615,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200201,8 +201669,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200255,8 +201723,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200309,8 +201777,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200363,8 +201831,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200417,8 +201885,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200471,8 +201939,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200525,8 +201993,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200579,8 +202047,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200633,8 +202101,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200687,8 +202155,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200741,8 +202209,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200795,8 +202263,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200849,8 +202317,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200903,8 +202371,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -200957,8 +202425,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201011,8 +202479,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201065,8 +202533,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201119,8 +202587,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201173,8 +202641,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201227,8 +202695,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201281,8 +202749,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201335,8 +202803,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201389,8 +202857,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201443,8 +202911,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201497,8 +202965,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201551,8 +203019,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201605,8 +203073,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201659,8 +203127,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201713,8 +203181,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201767,8 +203235,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201821,8 +203289,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201875,8 +203343,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201929,8 +203397,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -201983,8 +203451,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202037,8 +203505,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202091,8 +203559,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202145,8 +203613,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
@@ -202199,8 +203667,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml,-4
diff --git a/docs/mitre-map/detections.json b/docs/mitre-map/detections.json
index dfd2589521..ed8836188f 100644
--- a/docs/mitre-map/detections.json
+++ b/docs/mitre-map/detections.json
@@ -146454,35 +146454,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
-        },
-        {
-            "techniqueID": "T1027.002",
-            "score": 14,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.007",
-            "score": 14,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1045",
-            "score": 14,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.004",
-            "score": 14,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146506,9 +146480,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146532,9 +146506,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146558,9 +146532,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146584,9 +146558,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146610,9 +146584,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146636,9 +146610,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146662,9 +146636,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146688,9 +146662,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146714,9 +146688,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146740,9 +146714,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146766,9 +146740,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146792,9 +146766,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146818,9 +146792,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146844,9 +146818,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146870,9 +146844,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146896,9 +146870,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146922,9 +146896,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146948,9 +146922,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146974,9 +146948,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147000,9 +146974,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147026,9 +147000,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147052,9 +147026,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147078,9 +147052,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147104,9 +147078,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147130,9 +147104,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147156,9 +147130,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147182,9 +147156,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147208,9 +147182,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147234,9 +147208,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147260,9 +147234,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147286,9 +147260,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147312,9 +147286,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147338,9 +147312,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147364,9 +147338,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147390,9 +147364,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147416,9 +147390,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147442,9 +147416,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147468,9 +147442,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147494,9 +147468,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147520,9 +147494,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147546,9 +147520,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147572,9 +147546,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147598,9 +147572,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147624,9 +147598,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147650,9 +147624,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147676,9 +147650,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147702,9 +147676,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147728,9 +147702,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147754,9 +147728,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147780,9 +147754,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147806,9 +147780,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147832,9 +147806,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147858,9 +147832,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147884,9 +147858,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147910,9 +147884,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147936,9 +147910,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147962,9 +147936,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147988,9 +147962,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148014,9 +147988,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148040,9 +148014,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148066,9 +148040,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148092,9 +148066,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148118,9 +148092,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148144,9 +148118,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148170,9 +148144,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148196,9 +148170,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148222,9 +148196,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148248,9 +148222,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148274,9 +148248,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148300,9 +148274,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148326,9 +148300,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148352,9 +148326,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148378,9 +148352,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148404,9 +148378,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148430,9 +148404,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148456,9 +148430,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148482,9 +148456,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148508,9 +148482,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148534,9 +148508,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148560,9 +148534,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148586,9 +148560,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148612,9 +148586,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148638,9 +148612,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148664,9 +148638,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148690,9 +148664,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148716,9 +148690,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148742,9 +148716,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148768,9 +148742,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148794,9 +148768,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148820,9 +148794,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148846,9 +148820,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148872,9 +148846,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148898,9 +148872,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148924,9 +148898,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148950,9 +148924,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148976,9 +148950,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149002,9 +148976,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149028,9 +149002,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149054,9 +149028,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149080,9 +149054,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149106,9 +149080,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149132,9 +149106,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149158,9 +149132,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149184,9 +149158,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149210,9 +149184,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149236,9 +149210,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149262,9 +149236,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149288,9 +149262,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149314,9 +149288,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149340,9 +149314,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149366,9 +149340,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149392,9 +149366,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149418,9 +149392,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149444,9 +149418,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149470,9 +149444,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149496,35 +149470,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
-        },
-        {
-            "techniqueID": "T1027.002",
-            "score": 14,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.007",
-            "score": 14,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1045",
-            "score": 14,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.004",
-            "score": 14,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149548,9 +149496,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149574,9 +149522,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149600,9 +149548,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149626,9 +149574,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149652,9 +149600,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149678,9 +149626,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149704,9 +149652,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149730,9 +149678,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149756,9 +149704,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149782,9 +149730,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149808,9 +149756,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149834,9 +149782,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149860,9 +149808,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149886,9 +149834,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149912,9 +149860,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149938,9 +149886,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149964,9 +149912,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149990,9 +149938,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150016,9 +149964,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150042,9 +149990,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150068,9 +150016,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150094,9 +150042,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150120,9 +150068,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150146,9 +150094,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150172,9 +150120,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150198,9 +150146,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150224,9 +150172,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150250,9 +150198,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150276,9 +150224,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150302,9 +150250,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150328,9 +150276,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150354,9 +150302,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150380,9 +150328,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150406,9 +150354,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150432,9 +150380,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150458,9 +150406,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150484,9 +150432,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150510,9 +150458,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150536,9 +150484,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150562,9 +150510,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150588,9 +150536,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150614,9 +150562,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150640,9 +150588,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150666,9 +150614,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150692,9 +150640,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150718,9 +150666,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150744,9 +150692,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150770,9 +150718,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150796,9 +150744,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150822,9 +150770,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150848,9 +150796,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150874,9 +150822,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150900,9 +150848,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150926,9 +150874,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150952,9 +150900,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150978,9 +150926,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151004,9 +150952,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151030,9 +150978,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151056,9 +151004,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151082,9 +151030,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151108,9 +151056,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151134,9 +151082,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151160,9 +151108,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151186,9 +151134,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151212,9 +151160,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151238,9 +151186,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151264,9 +151212,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151290,9 +151238,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151316,9 +151264,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151342,9 +151290,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151368,9 +151316,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151394,9 +151342,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151420,9 +151368,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151446,9 +151394,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151472,9 +151420,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151498,9 +151446,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151524,9 +151472,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151550,9 +151498,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151576,9 +151524,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151602,9 +151550,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151628,9 +151576,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151654,9 +151602,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151680,9 +151628,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151706,9 +151654,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151732,9 +151680,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151758,9 +151706,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151784,9 +151732,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151810,9 +151758,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151836,9 +151784,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151862,9 +151810,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151888,9 +151836,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151914,9 +151862,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151940,9 +151888,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151966,9 +151914,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151992,9 +151940,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152018,9 +151966,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152044,9 +151992,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152070,9 +152018,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152096,9 +152044,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152122,9 +152070,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152148,9 +152096,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152174,9 +152122,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152200,9 +152148,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152226,9 +152174,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152252,9 +152200,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152278,9 +152226,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152304,9 +152252,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152330,9 +152278,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152356,9 +152304,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152382,9 +152330,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152408,9 +152356,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152434,9 +152382,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152460,9 +152408,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152486,9 +152434,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152512,9 +152460,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152538,35 +152486,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
-        },
-        {
-            "techniqueID": "T1027.002",
-            "score": 14,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.007",
-            "score": 14,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1045",
-            "score": 14,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.004",
-            "score": 14,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152590,9 +152512,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152616,9 +152538,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152642,9 +152564,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152668,9 +152590,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152694,9 +152616,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152720,9 +152642,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152746,9 +152668,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152772,9 +152694,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152798,9 +152720,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152824,9 +152746,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152850,9 +152772,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152876,9 +152798,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152902,9 +152824,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152928,9 +152850,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152954,9 +152876,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152980,9 +152902,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153006,9 +152928,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153032,9 +152954,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153058,9 +152980,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153084,9 +153006,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153110,9 +153032,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153136,9 +153058,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153162,9 +153084,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153188,9 +153110,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153214,9 +153136,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153240,9 +153162,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153266,9 +153188,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153292,9 +153214,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153318,9 +153240,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153344,9 +153266,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153370,9 +153292,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153396,9 +153318,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153422,9 +153344,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153448,9 +153370,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153474,9 +153396,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153500,9 +153422,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153526,9 +153448,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153552,9 +153474,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153578,9 +153500,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153604,9 +153526,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153630,9 +153552,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153656,9 +153578,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153682,9 +153604,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153708,9 +153630,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153734,9 +153656,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153760,9 +153682,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153786,9 +153708,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153812,9 +153734,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153838,9 +153760,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153864,9 +153786,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153890,9 +153812,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153916,9 +153838,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153942,9 +153864,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153968,9 +153890,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153994,9 +153916,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154020,9 +153942,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154046,9 +153968,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154072,9 +153994,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154098,9 +154020,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154124,9 +154046,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154150,9 +154072,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154176,9 +154098,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154202,9 +154124,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154228,9 +154150,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154254,9 +154176,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154280,9 +154202,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154306,9 +154228,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154332,9 +154254,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154358,9 +154280,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154384,9 +154306,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154410,9 +154332,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154436,9 +154358,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154462,9 +154384,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154488,9 +154410,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154514,9 +154436,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154540,9 +154462,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154566,9 +154488,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154592,9 +154514,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154618,9 +154540,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154644,9 +154566,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154670,9 +154592,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154696,9 +154618,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154722,9 +154644,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154748,9 +154670,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154774,9 +154696,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154800,9 +154722,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154826,9 +154748,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154852,9 +154774,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154878,9 +154800,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154904,9 +154826,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154930,9 +154852,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154956,9 +154878,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154982,9 +154904,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155008,9 +154930,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155034,9 +154956,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155060,9 +154982,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155086,9 +155008,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155112,9 +155034,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155138,9 +155060,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155164,9 +155086,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155190,9 +155112,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155216,9 +155138,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155242,9 +155164,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155268,9 +155190,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155294,9 +155216,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155320,9 +155242,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155346,9 +155268,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155372,9 +155294,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155398,9 +155320,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155424,9 +155346,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155450,9 +155372,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155476,9 +155398,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155502,9 +155424,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155528,9 +155450,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155554,9 +155476,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155580,9 +155502,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155606,9 +155528,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155632,9 +155554,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155658,9 +155580,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155684,9 +155606,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155710,9 +155632,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155736,9 +155658,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155762,9 +155684,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155788,9 +155710,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155814,9 +155736,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155840,9 +155762,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155866,9 +155788,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155892,9 +155814,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155918,9 +155840,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155944,9 +155866,9 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -155970,9 +155892,87 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": -4,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+        },
+        {
+            "techniqueID": "T1027.002",
+            "score": 14,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.007",
+            "score": 14,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1045",
+            "score": 14,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.004",
+            "score": 14,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.001",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+        },
+        {
+            "techniqueID": "T1027.002",
+            "score": 14,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.007",
+            "score": 14,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1045",
+            "score": 14,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.004",
+            "score": 14,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.001",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
+        },
+        {
+            "techniqueID": "T1027.002",
+            "score": 14,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.007",
+            "score": 14,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1045",
+            "score": 14,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.004",
+            "score": 14,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.001",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -165923,9 +165923,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -165978,9 +165978,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166033,9 +166033,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166088,9 +166088,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166143,9 +166143,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166198,9 +166198,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166253,9 +166253,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166308,9 +166308,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166363,9 +166363,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166418,9 +166418,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166473,9 +166473,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166528,9 +166528,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166583,9 +166583,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166638,9 +166638,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166693,9 +166693,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166748,9 +166748,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166803,9 +166803,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166858,9 +166858,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166913,9 +166913,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -166968,9 +166968,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167023,9 +167023,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167078,9 +167078,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167133,9 +167133,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167188,9 +167188,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167243,9 +167243,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167298,9 +167298,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167353,9 +167353,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167408,9 +167408,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167463,9 +167463,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167518,9 +167518,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167573,9 +167573,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167628,9 +167628,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167683,9 +167683,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167738,9 +167738,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167793,9 +167793,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167848,9 +167848,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167903,9 +167903,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -167958,9 +167958,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168013,9 +168013,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168068,9 +168068,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168123,9 +168123,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168178,9 +168178,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168233,9 +168233,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168288,9 +168288,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168343,9 +168343,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168398,9 +168398,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168453,9 +168453,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168508,9 +168508,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168563,9 +168563,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168618,9 +168618,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168673,9 +168673,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168728,9 +168728,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168783,9 +168783,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168838,9 +168838,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168893,9 +168893,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -168948,9 +168948,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169003,9 +169003,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169058,9 +169058,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169113,9 +169113,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169168,9 +169168,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169223,9 +169223,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169278,9 +169278,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169333,9 +169333,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169388,9 +169388,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169443,9 +169443,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169498,9 +169498,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169553,9 +169553,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169608,9 +169608,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169663,9 +169663,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169718,9 +169718,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169773,9 +169773,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169828,9 +169828,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169883,9 +169883,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169938,9 +169938,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -169993,9 +169993,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170048,9 +170048,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170103,9 +170103,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170158,9 +170158,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170213,9 +170213,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170268,9 +170268,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170323,9 +170323,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170378,9 +170378,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170433,9 +170433,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170488,9 +170488,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170543,9 +170543,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170598,9 +170598,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170653,9 +170653,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170708,9 +170708,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170763,9 +170763,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170818,9 +170818,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170873,9 +170873,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170928,9 +170928,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -170983,9 +170983,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171038,9 +171038,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171093,9 +171093,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171148,9 +171148,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171203,9 +171203,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171258,9 +171258,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171313,9 +171313,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171368,9 +171368,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171423,9 +171423,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171478,9 +171478,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171533,9 +171533,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171588,9 +171588,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171643,9 +171643,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171698,9 +171698,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171753,9 +171753,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171808,9 +171808,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171863,9 +171863,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171918,9 +171918,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -171973,9 +171973,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172028,9 +172028,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172083,9 +172083,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172138,9 +172138,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172193,9 +172193,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172248,9 +172248,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172303,9 +172303,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172358,9 +172358,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172413,9 +172413,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172468,9 +172468,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172523,9 +172523,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172578,9 +172578,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172633,9 +172633,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172688,9 +172688,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172743,9 +172743,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172798,9 +172798,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172853,9 +172853,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172908,9 +172908,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -172963,9 +172963,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173018,9 +173018,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173073,9 +173073,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173128,9 +173128,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173183,9 +173183,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173238,9 +173238,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173293,9 +173293,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173348,9 +173348,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173403,9 +173403,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173458,9 +173458,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173513,9 +173513,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173568,9 +173568,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173623,9 +173623,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173678,9 +173678,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173733,9 +173733,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173788,9 +173788,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173843,9 +173843,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173898,9 +173898,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -173953,9 +173953,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174008,9 +174008,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174063,9 +174063,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174118,9 +174118,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174173,9 +174173,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174228,9 +174228,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174283,9 +174283,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174338,9 +174338,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174393,9 +174393,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174448,9 +174448,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174503,9 +174503,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174558,9 +174558,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174613,9 +174613,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174668,9 +174668,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174723,9 +174723,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174778,9 +174778,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174833,9 +174833,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174888,9 +174888,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174943,9 +174943,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -174998,9 +174998,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175053,9 +175053,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175108,9 +175108,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175163,9 +175163,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175218,9 +175218,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175273,9 +175273,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175328,9 +175328,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175383,9 +175383,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175438,9 +175438,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175493,9 +175493,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175548,9 +175548,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175603,9 +175603,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175658,9 +175658,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175713,9 +175713,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175768,9 +175768,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175823,9 +175823,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175878,9 +175878,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175933,9 +175933,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -175988,9 +175988,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176043,9 +176043,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176098,9 +176098,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176153,9 +176153,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176208,9 +176208,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176263,9 +176263,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176318,9 +176318,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176373,9 +176373,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176428,9 +176428,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176483,9 +176483,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176538,9 +176538,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176593,9 +176593,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176648,9 +176648,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176703,9 +176703,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176758,9 +176758,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176813,9 +176813,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176868,9 +176868,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176923,9 +176923,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -176978,9 +176978,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177033,9 +177033,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177088,9 +177088,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177143,9 +177143,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177198,9 +177198,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177253,9 +177253,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177308,9 +177308,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177363,9 +177363,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177418,9 +177418,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177473,9 +177473,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177528,9 +177528,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177583,9 +177583,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177638,9 +177638,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177693,9 +177693,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177748,9 +177748,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177803,9 +177803,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177858,9 +177858,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177913,9 +177913,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -177968,9 +177968,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178023,9 +178023,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178078,9 +178078,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178133,9 +178133,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178188,9 +178188,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178243,9 +178243,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178298,9 +178298,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178353,9 +178353,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178408,9 +178408,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178463,9 +178463,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178518,9 +178518,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178573,9 +178573,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178628,9 +178628,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178683,9 +178683,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178738,9 +178738,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178793,9 +178793,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178848,9 +178848,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178903,9 +178903,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -178958,9 +178958,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179013,9 +179013,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179068,9 +179068,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179123,9 +179123,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179178,9 +179178,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179233,9 +179233,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179288,9 +179288,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179343,9 +179343,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179398,9 +179398,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179453,9 +179453,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179508,9 +179508,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179563,9 +179563,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179618,9 +179618,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179673,9 +179673,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179728,9 +179728,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179783,9 +179783,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179838,9 +179838,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179893,9 +179893,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -179948,9 +179948,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180003,9 +180003,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180058,9 +180058,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180113,9 +180113,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180168,9 +180168,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180223,9 +180223,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180278,9 +180278,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180333,9 +180333,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180388,9 +180388,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180443,9 +180443,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180498,9 +180498,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180553,9 +180553,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180608,9 +180608,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180663,9 +180663,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180718,9 +180718,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180773,9 +180773,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180828,9 +180828,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180883,9 +180883,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180938,9 +180938,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -180993,9 +180993,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181048,9 +181048,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181103,9 +181103,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181158,9 +181158,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181213,9 +181213,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181268,9 +181268,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181323,9 +181323,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181378,9 +181378,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181433,9 +181433,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181488,9 +181488,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181543,9 +181543,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181598,9 +181598,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181653,9 +181653,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181708,9 +181708,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181763,9 +181763,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181818,9 +181818,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181873,9 +181873,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181928,9 +181928,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -181983,9 +181983,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182038,9 +182038,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182093,9 +182093,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182148,9 +182148,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182203,9 +182203,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182258,9 +182258,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182313,9 +182313,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182368,9 +182368,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182423,9 +182423,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182478,9 +182478,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182533,9 +182533,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182588,9 +182588,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182643,9 +182643,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182698,9 +182698,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182753,9 +182753,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182808,9 +182808,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182863,9 +182863,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182918,9 +182918,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -182973,9 +182973,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183028,9 +183028,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183083,9 +183083,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183138,9 +183138,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183193,9 +183193,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183248,9 +183248,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183303,9 +183303,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183358,9 +183358,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183413,9 +183413,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183468,9 +183468,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183523,9 +183523,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183578,9 +183578,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183633,9 +183633,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183688,9 +183688,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183743,9 +183743,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183798,9 +183798,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183853,9 +183853,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183908,9 +183908,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -183963,9 +183963,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184018,9 +184018,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184073,9 +184073,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184128,9 +184128,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184183,9 +184183,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184238,9 +184238,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184293,9 +184293,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184348,9 +184348,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184403,9 +184403,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184458,9 +184458,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184513,9 +184513,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184568,9 +184568,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184623,9 +184623,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184678,9 +184678,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184733,9 +184733,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184788,9 +184788,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184843,9 +184843,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184898,9 +184898,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -184953,9 +184953,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185008,9 +185008,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185063,9 +185063,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185118,9 +185118,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185173,9 +185173,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185228,9 +185228,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185283,9 +185283,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185338,9 +185338,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185393,9 +185393,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185448,9 +185448,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185503,9 +185503,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185558,9 +185558,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185613,9 +185613,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185668,9 +185668,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185723,9 +185723,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185778,9 +185778,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185833,9 +185833,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185888,9 +185888,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185943,9 +185943,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -185998,9 +185998,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -186053,9 +186053,9 @@
         },
         {
             "techniqueID": "T1068",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.006",
@@ -207027,9 +207027,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -207115,9 +207115,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -207203,9 +207203,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -207291,9 +207291,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -207379,9 +207379,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -207467,9 +207467,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -207555,9 +207555,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -207643,9 +207643,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -207731,9 +207731,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -207819,9 +207819,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -207907,9 +207907,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -207995,9 +207995,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -208083,9 +208083,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -208171,9 +208171,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -208259,9 +208259,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -208347,9 +208347,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -208435,9 +208435,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -208523,9 +208523,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -208611,9 +208611,361 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+        },
+        {
+            "techniqueID": "T1117",
+            "score": 8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
+        },
+        {
+            "techniqueID": "T1090.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.005",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+        },
+        {
+            "techniqueID": "T1583.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1170",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.010",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
+        },
+        {
+            "techniqueID": "T1078.002",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
+        },
+        {
+            "techniqueID": "T1088",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1548.002",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+        },
+        {
+            "techniqueID": "T1099",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.004",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
+        },
+        {
+            "techniqueID": "T1007",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1070.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070.001",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+        },
+        {
+            "techniqueID": "T1117",
+            "score": 8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
+        },
+        {
+            "techniqueID": "T1090.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.005",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+        },
+        {
+            "techniqueID": "T1583.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1170",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.010",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
+        },
+        {
+            "techniqueID": "T1078.002",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
+        },
+        {
+            "techniqueID": "T1088",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1548.002",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+        },
+        {
+            "techniqueID": "T1099",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.004",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
+        },
+        {
+            "techniqueID": "T1007",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1070.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070.001",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+        },
+        {
+            "techniqueID": "T1117",
+            "score": 8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
+        },
+        {
+            "techniqueID": "T1090.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.005",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+        },
+        {
+            "techniqueID": "T1583.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1170",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.010",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
+        },
+        {
+            "techniqueID": "T1078.002",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
+        },
+        {
+            "techniqueID": "T1088",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1548.002",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+        },
+        {
+            "techniqueID": "T1099",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.004",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
+        },
+        {
+            "techniqueID": "T1007",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1070.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070.001",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+        },
+        {
+            "techniqueID": "T1117",
+            "score": 8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
+        },
+        {
+            "techniqueID": "T1090.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.005",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+        },
+        {
+            "techniqueID": "T1583.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1170",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.010",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
+        },
+        {
+            "techniqueID": "T1078.002",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
+        },
+        {
+            "techniqueID": "T1088",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1548.002",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+        },
+        {
+            "techniqueID": "T1099",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.004",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
+        },
+        {
+            "techniqueID": "T1007",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1070.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070.001",
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -208699,97 +209051,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
-        },
-        {
-            "techniqueID": "T1117",
-            "score": 8,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
-        },
-        {
-            "techniqueID": "T1090.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.005",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
-        },
-        {
-            "techniqueID": "T1583.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1170",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.010",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
-        },
-        {
-            "techniqueID": "T1078.002",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
-        },
-        {
-            "techniqueID": "T1088",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1590.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1548.002",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
-        },
-        {
-            "techniqueID": "T1099",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.004",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
-        },
-        {
-            "techniqueID": "T1007",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1070.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1070.001",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -208875,9 +209139,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -208963,9 +209227,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -209051,9 +209315,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -209139,9 +209403,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -209227,9 +209491,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -209315,9 +209579,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -209403,9 +209667,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -209491,9 +209755,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -209579,9 +209843,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -209667,9 +209931,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -209755,9 +210019,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -209843,9 +210107,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -209931,9 +210195,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -210019,9 +210283,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -210107,9 +210371,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -210195,9 +210459,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -210283,9 +210547,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -210371,9 +210635,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -210459,9 +210723,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -210547,9 +210811,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -210635,9 +210899,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -210723,9 +210987,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -210811,9 +211075,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -210899,9 +211163,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -210987,9 +211251,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -211075,9 +211339,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -211163,9 +211427,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -211251,9 +211515,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -211339,9 +211603,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -211427,9 +211691,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -211515,9 +211779,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -211603,9 +211867,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -211691,9 +211955,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -211779,9 +212043,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -211867,9 +212131,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -211955,9 +212219,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -212043,9 +212307,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -212131,9 +212395,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -212219,9 +212483,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -212307,9 +212571,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -212395,9 +212659,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -212483,9 +212747,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -212571,9 +212835,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -212659,9 +212923,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -212747,9 +213011,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -212835,9 +213099,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -212923,9 +213187,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -213011,9 +213275,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -213099,9 +213363,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -213187,9 +213451,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -213275,9 +213539,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -213363,9 +213627,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -213451,9 +213715,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -213539,9 +213803,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -213627,9 +213891,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -213715,9 +213979,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -213803,9 +214067,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -213891,9 +214155,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -213979,9 +214243,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -214067,9 +214331,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -214155,9 +214419,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -214243,9 +214507,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -214331,9 +214595,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -214419,9 +214683,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -214507,9 +214771,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -214595,9 +214859,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -214683,9 +214947,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -214771,9 +215035,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -214859,9 +215123,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -214947,9 +215211,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -215035,9 +215299,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -215123,9 +215387,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -215211,9 +215475,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -215299,9 +215563,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -215387,9 +215651,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -215475,9 +215739,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -215563,9 +215827,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -215651,9 +215915,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -215739,9 +216003,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -215827,9 +216091,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -215915,9 +216179,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -216003,9 +216267,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -216091,9 +216355,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -216179,9 +216443,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -216267,9 +216531,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -216355,97 +216619,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
-        },
-        {
-            "techniqueID": "T1117",
-            "score": 8,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
-        },
-        {
-            "techniqueID": "T1090.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.005",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
-        },
-        {
-            "techniqueID": "T1583.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1170",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.010",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
-        },
-        {
-            "techniqueID": "T1078.002",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
-        },
-        {
-            "techniqueID": "T1088",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1590.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1548.002",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
-        },
-        {
-            "techniqueID": "T1099",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.004",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
-        },
-        {
-            "techniqueID": "T1007",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1070.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1070.001",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -216531,9 +216707,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -216619,9 +216795,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -216707,9 +216883,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -216795,9 +216971,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -216883,9 +217059,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -216971,9 +217147,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -217059,9 +217235,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -217147,9 +217323,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -217235,9 +217411,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -217323,9 +217499,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -217411,9 +217587,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -217499,9 +217675,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -217587,9 +217763,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -217675,9 +217851,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -217763,9 +217939,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -217851,9 +218027,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -217939,9 +218115,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -218027,9 +218203,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -218115,9 +218291,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -218203,9 +218379,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -218291,9 +218467,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -218379,9 +218555,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -218467,9 +218643,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -218555,9 +218731,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -218643,9 +218819,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -218731,9 +218907,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -218819,9 +218995,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -218907,9 +219083,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -218995,9 +219171,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -219083,9 +219259,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -219171,9 +219347,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -219259,9 +219435,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -219347,9 +219523,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -219435,9 +219611,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -219523,9 +219699,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -219611,9 +219787,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -219699,9 +219875,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -219787,9 +219963,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -219875,9 +220051,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -219963,9 +220139,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -220051,9 +220227,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -220139,9 +220315,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -220227,9 +220403,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -220315,9 +220491,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -220403,9 +220579,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -220491,9 +220667,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -220579,9 +220755,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -220667,9 +220843,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -220755,9 +220931,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -220843,9 +221019,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -220931,9 +221107,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -221019,9 +221195,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -221107,9 +221283,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -221195,9 +221371,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -221283,9 +221459,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -221371,9 +221547,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -221459,9 +221635,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -221547,9 +221723,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -221635,9 +221811,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -221723,9 +221899,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -221811,9 +221987,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -221899,9 +222075,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -221987,9 +222163,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -222075,9 +222251,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -222163,9 +222339,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -222251,9 +222427,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -222339,9 +222515,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -222427,9 +222603,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -222515,9 +222691,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -222603,9 +222779,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -222691,9 +222867,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -222779,9 +222955,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -222867,9 +223043,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -222955,9 +223131,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -223043,9 +223219,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -223131,9 +223307,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -223219,9 +223395,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -223307,9 +223483,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -223395,9 +223571,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -223483,9 +223659,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -223571,9 +223747,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -223659,9 +223835,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -223747,9 +223923,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -223835,9 +224011,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -223923,9 +224099,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -224011,97 +224187,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
-        },
-        {
-            "techniqueID": "T1117",
-            "score": 8,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
-        },
-        {
-            "techniqueID": "T1090.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.005",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
-        },
-        {
-            "techniqueID": "T1583.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1170",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.010",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
-        },
-        {
-            "techniqueID": "T1078.002",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
-        },
-        {
-            "techniqueID": "T1088",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1590.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1548.002",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
-        },
-        {
-            "techniqueID": "T1099",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.004",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
-        },
-        {
-            "techniqueID": "T1007",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1070.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1070.001",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -224187,9 +224275,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -224275,9 +224363,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -224363,9 +224451,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -224451,9 +224539,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -224539,9 +224627,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -224627,9 +224715,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -224715,9 +224803,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -224803,9 +224891,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -224891,9 +224979,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -224979,9 +225067,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -225067,9 +225155,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -225155,9 +225243,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -225243,9 +225331,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -225331,9 +225419,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -225419,9 +225507,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -225507,9 +225595,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -225595,9 +225683,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -225683,9 +225771,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -225771,9 +225859,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -225859,9 +225947,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -225947,9 +226035,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -226035,9 +226123,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -226123,9 +226211,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -226211,9 +226299,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -226299,9 +226387,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -226387,9 +226475,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -226475,9 +226563,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -226563,9 +226651,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -226651,9 +226739,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -226739,9 +226827,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -226827,9 +226915,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -226915,9 +227003,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -227003,9 +227091,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -227091,9 +227179,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -227179,9 +227267,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -227267,9 +227355,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -227355,9 +227443,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -227443,9 +227531,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -227531,9 +227619,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -227619,9 +227707,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -227707,9 +227795,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -227795,9 +227883,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -227883,9 +227971,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -227971,9 +228059,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -228059,9 +228147,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -228147,9 +228235,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -228235,9 +228323,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -228323,9 +228411,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -228411,9 +228499,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -228499,9 +228587,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -228587,9 +228675,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -228675,9 +228763,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -228763,9 +228851,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -228851,9 +228939,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -228939,9 +229027,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -229027,9 +229115,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -229115,9 +229203,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -229203,9 +229291,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -229291,9 +229379,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -229379,9 +229467,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -229467,9 +229555,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -229555,9 +229643,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -229643,9 +229731,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -229731,9 +229819,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -229819,9 +229907,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -229907,9 +229995,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -229995,9 +230083,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -230083,9 +230171,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -230171,9 +230259,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -230259,9 +230347,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -230347,9 +230435,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -230435,9 +230523,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -230523,9 +230611,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -230611,9 +230699,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -230699,9 +230787,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -230787,9 +230875,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -230875,9 +230963,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -230963,9 +231051,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -231051,9 +231139,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -231139,9 +231227,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -231227,9 +231315,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -231315,9 +231403,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -231403,9 +231491,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -231491,9 +231579,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -231579,9 +231667,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -231667,97 +231755,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
-        },
-        {
-            "techniqueID": "T1117",
-            "score": 8,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
-        },
-        {
-            "techniqueID": "T1090.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.005",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
-        },
-        {
-            "techniqueID": "T1583.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1170",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.010",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
-        },
-        {
-            "techniqueID": "T1078.002",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
-        },
-        {
-            "techniqueID": "T1088",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1590.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1548.002",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
-        },
-        {
-            "techniqueID": "T1099",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.004",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
-        },
-        {
-            "techniqueID": "T1007",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1070.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1070.001",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -231843,9 +231843,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -231931,9 +231931,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -232019,9 +232019,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -232107,9 +232107,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -232195,9 +232195,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -232283,9 +232283,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -232371,9 +232371,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -232459,9 +232459,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -232547,9 +232547,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -232635,9 +232635,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -232723,9 +232723,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -232811,9 +232811,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -232899,9 +232899,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -232987,9 +232987,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -233075,9 +233075,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -233163,9 +233163,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -233251,9 +233251,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -233339,9 +233339,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -233427,9 +233427,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -233515,9 +233515,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -233603,9 +233603,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -233691,9 +233691,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -233779,9 +233779,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -233867,9 +233867,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -233955,9 +233955,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -234043,9 +234043,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -234131,9 +234131,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -234219,9 +234219,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -234307,9 +234307,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -234395,9 +234395,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -234483,9 +234483,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -234571,9 +234571,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -234659,9 +234659,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -234747,9 +234747,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -234835,9 +234835,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -234923,9 +234923,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -235011,9 +235011,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -235099,9 +235099,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -235187,9 +235187,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -235275,9 +235275,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -235363,9 +235363,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -235451,9 +235451,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -235539,9 +235539,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -235627,9 +235627,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -235715,9 +235715,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -235803,9 +235803,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -235891,9 +235891,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -235979,9 +235979,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -236067,9 +236067,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -236155,9 +236155,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -236243,9 +236243,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -236331,9 +236331,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -236419,9 +236419,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -236507,9 +236507,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -236595,9 +236595,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -236683,9 +236683,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -236771,9 +236771,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -236859,9 +236859,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -236947,9 +236947,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -237035,9 +237035,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -237123,9 +237123,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -237211,9 +237211,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -237299,9 +237299,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -237387,9 +237387,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -237475,9 +237475,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -237563,9 +237563,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -237651,9 +237651,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -237739,9 +237739,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -237827,9 +237827,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -237915,9 +237915,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -238003,9 +238003,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -238091,9 +238091,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -238179,9 +238179,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -238267,9 +238267,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -238355,9 +238355,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -238443,9 +238443,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -238531,9 +238531,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -238619,9 +238619,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -238707,9 +238707,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -238795,9 +238795,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -238883,9 +238883,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -238971,9 +238971,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -239059,9 +239059,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -239147,9 +239147,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -239235,9 +239235,9 @@
         },
         {
             "techniqueID": "T1070.001",
-            "score": 5,
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
         },
         {
             "techniqueID": "T1117",
@@ -452298,7 +452298,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -452501,7 +452501,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -452704,7 +452704,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -452907,7 +452907,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453110,7 +453110,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453313,7 +453313,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453516,7 +453516,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453719,7 +453719,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453922,7 +453922,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454125,7 +454125,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454328,7 +454328,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454531,7 +454531,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454734,7 +454734,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454937,7 +454937,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455140,7 +455140,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455343,7 +455343,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455546,7 +455546,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455749,7 +455749,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455952,7 +455952,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456155,7 +456155,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456358,7 +456358,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456561,7 +456561,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456764,7 +456764,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456967,7 +456967,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457170,7 +457170,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457373,7 +457373,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457576,7 +457576,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457779,7 +457779,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457982,7 +457982,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458185,7 +458185,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458388,7 +458388,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458591,7 +458591,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458794,7 +458794,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458997,7 +458997,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459200,7 +459200,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459403,7 +459403,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459606,7 +459606,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459809,7 +459809,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460012,7 +460012,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460215,7 +460215,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460418,7 +460418,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460621,7 +460621,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460824,7 +460824,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461027,7 +461027,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461230,7 +461230,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461433,7 +461433,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461636,7 +461636,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461839,7 +461839,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462042,7 +462042,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462245,7 +462245,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462448,7 +462448,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462651,7 +462651,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462854,7 +462854,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463057,7 +463057,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463260,7 +463260,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463463,7 +463463,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463666,7 +463666,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463869,7 +463869,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464072,7 +464072,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464275,7 +464275,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464478,7 +464478,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464681,7 +464681,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464884,7 +464884,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465087,7 +465087,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465290,7 +465290,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465493,7 +465493,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465696,7 +465696,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465899,7 +465899,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466102,7 +466102,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466305,7 +466305,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466508,7 +466508,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466711,7 +466711,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466914,7 +466914,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467117,7 +467117,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467320,7 +467320,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467523,7 +467523,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467726,7 +467726,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467929,7 +467929,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468132,7 +468132,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468335,7 +468335,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468538,7 +468538,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468741,7 +468741,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468944,7 +468944,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469147,7 +469147,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469350,7 +469350,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469553,7 +469553,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469756,7 +469756,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469959,7 +469959,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470162,7 +470162,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470365,7 +470365,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470568,7 +470568,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470771,7 +470771,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470974,7 +470974,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471177,7 +471177,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471380,7 +471380,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471583,7 +471583,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471786,7 +471786,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471989,7 +471989,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472192,7 +472192,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472395,7 +472395,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472598,7 +472598,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472801,7 +472801,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473004,7 +473004,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473207,7 +473207,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473410,7 +473410,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473613,7 +473613,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473816,7 +473816,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474019,7 +474019,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474222,7 +474222,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474425,7 +474425,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474628,7 +474628,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474831,7 +474831,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475034,7 +475034,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475237,7 +475237,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475440,7 +475440,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475643,7 +475643,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475846,7 +475846,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476049,7 +476049,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476252,7 +476252,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476455,7 +476455,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476658,7 +476658,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476861,7 +476861,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477064,7 +477064,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477267,7 +477267,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477470,7 +477470,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477673,7 +477673,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477876,7 +477876,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478079,7 +478079,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478282,7 +478282,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478485,7 +478485,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478688,7 +478688,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478891,7 +478891,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479094,7 +479094,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479297,7 +479297,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479500,7 +479500,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479703,7 +479703,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479906,7 +479906,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480109,7 +480109,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480312,7 +480312,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480515,7 +480515,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480718,7 +480718,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480921,7 +480921,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481124,7 +481124,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481327,7 +481327,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481530,7 +481530,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481733,7 +481733,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481936,7 +481936,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482139,7 +482139,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482342,7 +482342,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482545,7 +482545,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482748,7 +482748,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482951,7 +482951,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483154,7 +483154,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483357,7 +483357,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483560,7 +483560,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483763,7 +483763,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483966,7 +483966,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484169,7 +484169,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484372,7 +484372,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484575,7 +484575,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484778,7 +484778,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484981,7 +484981,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485184,7 +485184,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485387,7 +485387,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485590,7 +485590,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485793,7 +485793,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485996,7 +485996,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -486199,7 +486199,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -486402,7 +486402,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -486605,7 +486605,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -486808,7 +486808,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487011,7 +487011,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487214,7 +487214,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487417,7 +487417,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487620,7 +487620,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487823,7 +487823,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488026,7 +488026,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488229,7 +488229,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488432,7 +488432,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488635,7 +488635,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488838,7 +488838,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489041,7 +489041,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489244,7 +489244,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489447,7 +489447,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489650,7 +489650,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489853,7 +489853,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490056,7 +490056,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490259,7 +490259,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490462,7 +490462,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490665,7 +490665,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490868,7 +490868,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491071,7 +491071,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491274,7 +491274,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491477,7 +491477,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491680,7 +491680,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491883,7 +491883,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492086,7 +492086,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492289,7 +492289,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492492,7 +492492,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492695,7 +492695,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492898,7 +492898,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493101,7 +493101,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493304,7 +493304,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493507,7 +493507,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493710,7 +493710,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493913,7 +493913,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494116,7 +494116,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494319,7 +494319,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494522,7 +494522,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494725,7 +494725,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494928,7 +494928,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495131,7 +495131,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495334,7 +495334,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495537,7 +495537,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495740,7 +495740,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495943,7 +495943,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496146,7 +496146,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496349,7 +496349,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496552,7 +496552,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496755,7 +496755,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496958,7 +496958,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497161,7 +497161,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497364,7 +497364,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497567,7 +497567,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497770,7 +497770,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497973,7 +497973,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498176,7 +498176,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498379,7 +498379,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498582,7 +498582,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498785,7 +498785,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498988,7 +498988,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499191,7 +499191,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499394,7 +499394,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499597,7 +499597,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499800,7 +499800,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500003,7 +500003,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500206,7 +500206,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500409,7 +500409,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500612,7 +500612,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500815,7 +500815,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501018,7 +501018,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501221,7 +501221,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501424,7 +501424,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501627,7 +501627,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501830,7 +501830,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502033,7 +502033,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502236,7 +502236,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502439,7 +502439,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502642,7 +502642,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502845,7 +502845,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503048,7 +503048,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503251,7 +503251,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503454,7 +503454,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503657,7 +503657,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503860,7 +503860,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504063,7 +504063,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504266,7 +504266,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504469,7 +504469,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504672,7 +504672,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504875,7 +504875,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505078,7 +505078,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505281,7 +505281,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505484,7 +505484,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505687,7 +505687,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505890,7 +505890,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506093,7 +506093,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506296,7 +506296,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506499,7 +506499,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506702,7 +506702,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506905,7 +506905,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507108,7 +507108,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507311,7 +507311,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507514,7 +507514,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507717,7 +507717,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507920,7 +507920,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508123,7 +508123,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508326,7 +508326,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508529,7 +508529,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508732,7 +508732,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508935,7 +508935,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509138,7 +509138,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509341,7 +509341,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509544,7 +509544,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509747,7 +509747,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509950,7 +509950,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510153,7 +510153,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510356,7 +510356,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510559,7 +510559,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510762,7 +510762,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510965,7 +510965,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511168,7 +511168,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511371,7 +511371,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511574,7 +511574,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511777,7 +511777,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511980,7 +511980,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512183,7 +512183,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512386,7 +512386,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512589,7 +512589,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512792,7 +512792,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512995,7 +512995,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513198,7 +513198,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513401,7 +513401,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513604,7 +513604,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513807,7 +513807,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514010,7 +514010,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514213,7 +514213,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514416,7 +514416,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514619,7 +514619,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514822,7 +514822,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515025,7 +515025,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515228,7 +515228,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515431,7 +515431,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515634,7 +515634,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515837,7 +515837,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516040,7 +516040,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516243,7 +516243,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516446,7 +516446,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516649,7 +516649,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516852,7 +516852,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517055,7 +517055,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517258,7 +517258,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517461,7 +517461,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517664,7 +517664,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517867,7 +517867,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518070,7 +518070,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518273,7 +518273,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518476,7 +518476,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518679,7 +518679,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518882,7 +518882,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519085,7 +519085,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519288,7 +519288,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519491,7 +519491,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519694,7 +519694,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519897,7 +519897,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520100,7 +520100,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520303,7 +520303,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520506,7 +520506,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520709,7 +520709,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520912,7 +520912,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521115,7 +521115,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521318,7 +521318,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521521,7 +521521,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521724,7 +521724,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521927,7 +521927,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522130,7 +522130,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522333,7 +522333,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522536,7 +522536,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522739,7 +522739,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522942,7 +522942,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -523145,7 +523145,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -523348,7 +523348,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -523551,7 +523551,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -523754,7 +523754,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -523957,7 +523957,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -524160,7 +524160,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -524363,7 +524363,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -524566,7 +524566,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -524769,7 +524769,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -524972,7 +524972,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -525175,7 +525175,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -525378,7 +525378,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -525581,7 +525581,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -525784,7 +525784,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -525987,7 +525987,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -526190,7 +526190,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -526393,7 +526393,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -526596,7 +526596,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
diff --git a/docs/stories.md b/docs/stories.md
index 339030f9a0..c2d149be41 100644
--- a/docs/stories.md
+++ b/docs/stories.md
@@ -259,7 +259,7 @@ Adversaries may abuse BITS jobs to persistently execute or clean up after malici
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1197 | BITS Jobs | Defense Evasion, Persistence |
-| T1105 | Ingress Tool Transfer | Command and Control |
+| T1105 | Ingress Tool Transfer | Command And Control |
 
 #### Kill Chain Phase
 
@@ -375,20 +375,20 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 | T1059.003 | Windows Command Shell | Execution |
 | T1543.003 | Windows Service | Persistence, Privilege Escalation |
 | T1055 | Process Injection | Defense Evasion, Privilege Escalation |
-| T1071.002 | File Transfer Protocols | Command and Control |
+| T1071.002 | File Transfer Protocols | Command And Control |
 | T1218.010 | Regsvr32 | Defense Evasion |
 | T1218.005 | Mshta | Defense Evasion |
 | T1569.002 | Service Execution | Execution |
 | T1027 | Obfuscated Files or Information | Defense Evasion |
 | T1218.011 | Rundll32 | Defense Evasion |
 | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation |
-| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
 | T1203 | Exploitation for Client Execution | Execution |
 | T1505.003 | Web Shell | Persistence |
 | T1127.001 | MSBuild | Defense Evasion |
 | T1036.003 | Rename System Utilities | Defense Evasion |
 | T1127 | Trusted Developer Utilities Proxy Execution | Defense Evasion |
-| T1071.001 | Web Protocols | Command and Control |
+| T1071.001 | Web Protocols | Command And Control |
 | T1018 | Remote System Discovery | Discovery |
 
 #### Kill Chain Phase
@@ -525,15 +525,15 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
-| T1071.004 | DNS | Command and Control |
+| T1071.004 | DNS | Command And Control |
 | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
-| T1095 | Non-Application Layer Protocol | Command and Control |
+| T1095 | Non-Application Layer Protocol | Command And Control |
 | T1041 | Exfiltration Over C2 Channel | Exfiltration |
 | T1189 | Drive-by Compromise | Initial Access |
 | T1114.001 | Local Email Collection | Collection |
 | T1114 | Email Collection | Collection |
 | T1114.003 | Email Forwarding Rule | Collection |
-| T1071.001 | Web Protocols | Command and Control |
+| T1071.001 | Web Protocols | Command And Control |
 
 #### Kill Chain Phase
 
@@ -645,12 +645,12 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 | T1003.001 | LSASS Memory | Credential Access |
 | T1055 | Process Injection | Defense Evasion, Privilege Escalation |
 | T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
-| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 | T1098 | Account Manipulation | Persistence |
 | T1134 | Access Token Manipulation | Defense Evasion, Privilege Escalation |
 | T1543 | Create or Modify System Process | Persistence, Privilege Escalation |
 | T1547 | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
-| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
 | T1554 | Compromise Client Software Binary | Persistence |
 | T1556 | Modify Authentication Process | Credential Access, Defense Evasion, Persistence |
 | T1558 | Steal or Forge Kerberos Tickets | Credential Access |
@@ -767,15 +767,15 @@ The stealing of data by an adversary.
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
-| T1071.004 | DNS | Command and Control |
+| T1071.004 | DNS | Command And Control |
 | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
-| T1095 | Non-Application Layer Protocol | Command and Control |
+| T1095 | Non-Application Layer Protocol | Command And Control |
 | T1041 | Exfiltration Over C2 Channel | Exfiltration |
 | T1189 | Drive-by Compromise | Initial Access |
 | T1114.001 | Local Email Collection | Collection |
 | T1114 | Email Collection | Collection |
 | T1114.003 | Email Forwarding Rule | Collection |
-| T1071.001 | Web Protocols | Command and Control |
+| T1071.001 | Web Protocols | Command And Control |
 
 #### Kill Chain Phase
 
@@ -1151,7 +1151,7 @@ Adversaries may transfer tools or other files from an external system into a com
 | ----------- | ----------- |--------------|
 | T1059.001 | PowerShell | Execution |
 | T1197 | BITS Jobs | Defense Evasion, Persistence |
-| T1105 | Ingress Tool Transfer | Command and Control |
+| T1105 | Ingress Tool Transfer | Command And Control |
 | T1003 | OS Credential Dumping | Credential Access |
 | T1021 | Remote Services | Lateral Movement |
 | T1113 | Screen Capture | Collection |
@@ -1159,7 +1159,7 @@ Adversaries may transfer tools or other files from an external system into a com
 | T1563 | Remote Service Session Hijacking | Lateral Movement |
 | T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
 | T1134 | Access Token Manipulation | Defense Evasion, Privilege Escalation |
-| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
 | T1055 | Process Injection | Defense Evasion, Privilege Escalation |
 | T1106 | Native API | Execution |
 | T1569 | System Services | Execution |
@@ -1320,7 +1320,7 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an
 | ----------- | ----------- |--------------|
 | T1059.001 | PowerShell | Execution |
 | T1197 | BITS Jobs | Defense Evasion, Persistence |
-| T1105 | Ingress Tool Transfer | Command and Control |
+| T1105 | Ingress Tool Transfer | Command And Control |
 | T1003 | OS Credential Dumping | Credential Access |
 | T1021 | Remote Services | Lateral Movement |
 | T1113 | Screen Capture | Collection |
@@ -1328,7 +1328,7 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an
 | T1563 | Remote Service Session Hijacking | Lateral Movement |
 | T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
 | T1134 | Access Token Manipulation | Defense Evasion, Privilege Escalation |
-| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
 | T1055 | Process Injection | Defense Evasion, Privilege Escalation |
 | T1106 | Native API | Execution |
 | T1569 | System Services | Execution |
@@ -1509,20 +1509,20 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 | T1059.003 | Windows Command Shell | Execution |
 | T1543.003 | Windows Service | Persistence, Privilege Escalation |
 | T1055 | Process Injection | Defense Evasion, Privilege Escalation |
-| T1071.002 | File Transfer Protocols | Command and Control |
+| T1071.002 | File Transfer Protocols | Command And Control |
 | T1218.010 | Regsvr32 | Defense Evasion |
 | T1218.005 | Mshta | Defense Evasion |
 | T1569.002 | Service Execution | Execution |
 | T1027 | Obfuscated Files or Information | Defense Evasion |
 | T1218.011 | Rundll32 | Defense Evasion |
 | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation |
-| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
 | T1203 | Exploitation for Client Execution | Execution |
 | T1505.003 | Web Shell | Persistence |
 | T1127.001 | MSBuild | Defense Evasion |
 | T1036.003 | Rename System Utilities | Defense Evasion |
 | T1127 | Trusted Developer Utilities Proxy Execution | Defense Evasion |
-| T1071.001 | Web Protocols | Command and Control |
+| T1071.001 | Web Protocols | Command And Control |
 | T1018 | Remote System Discovery | Discovery |
 
 #### Kill Chain Phase
@@ -1667,7 +1667,7 @@ Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1105 | Ingress Tool Transfer | Command and Control |
+| T1105 | Ingress Tool Transfer | Command And Control |
 | T1543.001 | Launch Agent | Persistence, Privilege Escalation |
 | T1074 | Data Staged | Collection |
 
@@ -1891,15 +1891,15 @@ Attackers often attempt to hide within or otherwise abuse the domain name system
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
-| T1071.004 | DNS | Command and Control |
+| T1071.004 | DNS | Command And Control |
 | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
-| T1095 | Non-Application Layer Protocol | Command and Control |
+| T1095 | Non-Application Layer Protocol | Command And Control |
 | T1041 | Exfiltration Over C2 Channel | Exfiltration |
 | T1189 | Drive-by Compromise | Initial Access |
 | T1114.001 | Local Email Collection | Collection |
 | T1114 | Email Collection | Collection |
 | T1114.003 | Email Forwarding Rule | Collection |
-| T1071.001 | Web Protocols | Command and Control |
+| T1071.001 | Web Protocols | Command And Control |
 
 #### Kill Chain Phase
 
@@ -2053,7 +2053,7 @@ Monitor your Okta environment for suspicious activities. Due to the Covid outbre
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1078.001 | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1078.001 | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 
 #### Kill Chain Phase
 
@@ -2261,7 +2261,7 @@ Attackers are increasingly abusing Windows Management Instrumentation (WMI), a f
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1546.003 | Windows Management Instrumentation Event Subscription | Persistence, Privilege Escalation |
+| T1546.003 | Windows Management Instrumentation Event Subscription | Privilege Escalation, Persistence |
 | T1047 | Windows Management Instrumentation | Execution |
 
 #### Kill Chain Phase
@@ -2311,11 +2311,11 @@ Monitor and detect registry changes initiated from remote locations, which can b
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion |
 | T1547.010 | Port Monitors | Persistence, Privilege Escalation |
 | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation |
-| T1546.012 | Image File Execution Options Injection | Persistence, Privilege Escalation |
-| T1546.011 | Application Shimming | Persistence, Privilege Escalation |
+| T1546.012 | Image File Execution Options Injection | Privilege Escalation, Persistence |
+| T1546.011 | Application Shimming | Privilege Escalation, Persistence |
 
 #### Kill Chain Phase
 
@@ -2556,6 +2556,8 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 
 * [Eventvwr UAC Bypass](detections.md#eventvwr-uac-bypass)
 
+* [Excessive number of service control start as disabled](detections.md#excessive-number-of-service-control-start-as-disabled)
+
 * [FodHelper UAC Bypass](detections.md#fodhelper-uac-bypass)
 
 * [Hiding Files And Directories With Attrib exe](detections.md#hiding-files-and-directories-with-attrib-exe)
@@ -2577,7 +2579,7 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 | ----------- | ----------- |--------------|
 | T1562.001 | Disable or Modify Tools | Defense Evasion |
 | T1564.001 | Hidden Files and Directories | Defense Evasion |
-| T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion |
 | T1112 | Modify Registry | Defense Evasion |
 | T1222.001 | Windows File and Directory Permissions Modification | Defense Evasion |
 | T1036 | Masquerading | Defense Evasion |
@@ -2651,7 +2653,7 @@ Monitors for behaviors associated with adversaries discovering objects in the en
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 | T1087 | Account Discovery | Discovery |
 | T1484 | Domain Policy Modification | Defense Evasion, Privilege Escalation |
 | T1199 | Trusted Relationship | Initial Access |
@@ -2675,7 +2677,7 @@ Monitors for behaviors associated with adversaries discovering objects in the en
 | T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
 | T1543 | Create or Modify System Process | Persistence, Privilege Escalation |
 | T1547 | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
-| T1574 | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation |
+| T1574 | Hijack Execution Flow | Persistence, Privilege Escalation, Defense Evasion |
 | T1589.001 | Credentials | Reconnaissance |
 | T1590.001 | Domain Properties | Reconnaissance |
 | T1590.003 | Network Trust Dependencies | Reconnaissance |
@@ -2725,6 +2727,10 @@ Adversaries often try to cover their tracks by manipulating Windows logs. Use th
 
 * [USN Journal Deletion](detections.md#usn-journal-deletion)
 
+* [WevtUtil Usage To Clear Logs](detections.md#wevtutil-usage-to-clear-logs)
+
+* [Wevtutil Usage To Disable Logs](detections.md#wevtutil-usage-to-disable-logs)
+
 * [Windows Event Log Cleared](detections.md#windows-event-log-cleared)
 
 
@@ -2740,6 +2746,8 @@ Adversaries often try to cover their tracks by manipulating Windows logs. Use th
 
 * Actions on Objectives
 
+* Exploitation
+
 
 #### Reference
 
@@ -2821,20 +2829,20 @@ Monitor for activities and techniques associated with maintaining persistence on
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1574.009 | Path Interception by Unquoted Path | Defense Evasion, Persistence, Privilege Escalation |
+| T1574.009 | Path Interception by Unquoted Path | Persistence, Privilege Escalation, Defense Evasion |
 | T1222.001 | Windows File and Directory Permissions Modification | Defense Evasion |
 | T1585 | Establish Accounts | Resource Development |
-| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 | T1098 | Account Manipulation | Persistence |
 | T1207 | Rogue Domain Controller | Defense Evasion |
 | T1484 | Domain Policy Modification | Defense Evasion, Privilege Escalation |
 | T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
 | T1134 | Access Token Manipulation | Defense Evasion, Privilege Escalation |
-| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
 | T1547.010 | Port Monitors | Persistence, Privilege Escalation |
-| T1574.011 | Services Registry Permissions Weakness | Defense Evasion, Persistence, Privilege Escalation |
+| T1574.011 | Services Registry Permissions Weakness | Persistence, Privilege Escalation, Defense Evasion |
 | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation |
-| T1546.011 | Application Shimming | Persistence, Privilege Escalation |
+| T1546.011 | Application Shimming | Privilege Escalation, Persistence |
 | T1543.003 | Windows Service | Persistence, Privilege Escalation |
 | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation |
 | T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
@@ -2898,11 +2906,11 @@ Monitor for and investigate activities that may be associated with a Windows pri
 | ----------- | ----------- |--------------|
 | T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
 | T1134 | Access Token Manipulation | Defense Evasion, Privilege Escalation |
-| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
-| T1546.008 | Accessibility Features | Persistence, Privilege Escalation |
-| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
+| T1546.008 | Accessibility Features | Privilege Escalation, Persistence |
+| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 | T1098 | Account Manipulation | Persistence |
-| T1546.012 | Image File Execution Options Injection | Persistence, Privilege Escalation |
+| T1546.012 | Image File Execution Options Injection | Privilege Escalation, Persistence |
 
 #### Kill Chain Phase
 
@@ -3038,7 +3046,7 @@ Detect instances of prohibited network traffic allowed in the environment, as we
 | T1021 | Remote Services | Lateral Movement |
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
 | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
-| T1071.001 | Web Protocols | Command and Control |
+| T1071.001 | Web Protocols | Command And Control |
 
 #### Kill Chain Phase
 
@@ -3095,8 +3103,8 @@ Validate the security configuration of network infrastructure and verify that on
 | ----------- | ----------- |--------------|
 | T1200 | Hardware Additions | Initial Access |
 | T1498 | Network Denial of Service | Impact |
-| T1557.002 | ARP Cache Poisoning | Collection, Credential Access |
-| T1557 | Man-in-the-Middle | Collection, Credential Access |
+| T1557.002 | ARP Cache Poisoning | Credential Access, Collection |
+| T1557 | Man-in-the-Middle | Credential Access, Collection |
 | T1542.005 | TFTP Boot | Defense Evasion, Persistence |
 | T1020.001 | Traffic Duplication | Exfiltration |
 
@@ -3195,7 +3203,7 @@ Track when a user assumes an IAM role in another AWS account to obtain cross-acc
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 | T1550 | Use Alternate Authentication Material | Defense Evasion, Lateral Movement |
 
 #### Kill Chain Phase
@@ -3249,7 +3257,7 @@ This analytic story contains detections that query your AWS Cloudtrail for activ
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 | T1136.003 | Cloud Account | Persistence |
 | T1580 | Cloud Infrastructure Discovery | Discovery |
 | T1110 | Brute Force | Credential Access |
@@ -3425,7 +3433,7 @@ Monitor your cloud compute instances for activities related to cryptojacking/cry
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 | T1535 | Unused/Unsupported Cloud Regions | Defense Evasion |
 
 #### Kill Chain Phase
@@ -3481,11 +3489,11 @@ This analytical story addresses events that indicate abuse of cloud federated cr
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 | T1003.001 | LSASS Memory | Credential Access |
 | T1136.003 | Cloud Account | Persistence |
 | T1556 | Modify Authentication Process | Credential Access, Defense Evasion, Persistence |
-| T1546.012 | Image File Execution Options Injection | Persistence, Privilege Escalation |
+| T1546.012 | Image File Execution Options Injection | Privilege Escalation, Persistence |
 
 #### Kill Chain Phase
 
@@ -3567,7 +3575,7 @@ Track when a user assumes an IAM role in another GCP account to obtain cross-acc
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 
 #### Kill Chain Phase
 
@@ -3926,7 +3934,7 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 
 #### Kill Chain Phase
 
@@ -3969,7 +3977,7 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 
 #### Kill Chain Phase
 
@@ -4011,8 +4019,8 @@ Detect and investigate suspicious activities by users and roles in your cloud en
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1580 | Cloud Infrastructure Discovery | Discovery |
-| T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
-| T1078 | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
+| T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
+| T1078 | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
 
 #### Kill Chain Phase
 
@@ -4069,6 +4077,75 @@ Use the searches in this Analytic Story to monitor your GCP Storage buckets for
 * https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/
 
 
+_version_: 1
+
+
+---
+
+
+
+## Lateral Movement
+

+  details
+
+### PrintNightmare CVE-2021-34527
+The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1068](https://attack.mitre.org/techniques/T1068/), [T1218.011](https://attack.mitre.org/techniques/T1218.011/), [T1547.012](https://attack.mitre.org/techniques/T1547.012/)
+- **Last Updated**: 2021-07-01
+
+

+  details
+
+#### Detection Profile
+
+* [Print Spooler Adding A Printer Driver](detections.md#print-spooler-adding-a-printer-driver)
+
+* [Print Spooler Failed to Load a Plug-in](detections.md#print-spooler-failed-to-load-a-plug-in)
+
+* [Rundll32 with no Command Line Arguments with Network](detections.md#rundll32-with-no-command-line-arguments-with-network)
+
+* [Spoolsv Spawning Rundll32](detections.md#spoolsv-spawning-rundll32)
+
+* [Spoolsv Suspicious Loaded Modules](detections.md#spoolsv-suspicious-loaded-modules)
+
+* [Spoolsv Suspicious Process Access](detections.md#spoolsv-suspicious-process-access)
+
+* [Spoolsv Writing a DLL](detections.md#spoolsv-writing-a-dll)
+
+* [Spoolsv Writing a DLL - Sysmon](detections.md#spoolsv-writing-a-dll---sysmon)
+
+* [Suspicious Rundll32 no Command Line Arguments](detections.md#suspicious-rundll32-no-command-line-arguments)
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1547.012 | Print Processors | Persistence, Privilege Escalation |
+| T1218.011 | Rundll32 | Defense Evasion |
+| T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
+
+#### Kill Chain Phase
+
+* Actions on Objectives
+
+* Exploitation
+
+
+#### Reference
+
+* https://github.com/cube0x0/CVE-2021-1675/
+
+* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
+
+* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
+
+* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
+
+
 _version_: 1
 

 
@@ -4119,6 +4196,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Suspicious wevtutil Usage](detections.md#suspicious-wevtutil-usage)
 
+* [WevtUtil Usage To Clear Logs](detections.md#wevtutil-usage-to-clear-logs)
+
 * [Windows Event Log Cleared](detections.md#windows-event-log-cleared)
 
 
@@ -4248,7 +4327,7 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1136.001 | Local Account | Persistence |
-| T1071.002 | File Transfer Protocols | Command and Control |
+| T1071.002 | File Transfer Protocols | Command And Control |
 | T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
 | T1569.002 | Service Execution | Execution |
 | T1059.001 | PowerShell | Execution |
@@ -4336,7 +4415,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | ----------- | ----------- |--------------|
 | T1003.002 | Security Account Manager | Credential Access |
 | T1197 | BITS Jobs | Defense Evasion, Persistence |
-| T1105 | Ingress Tool Transfer | Command and Control |
+| T1105 | Ingress Tool Transfer | Command And Control |
 | T1218.003 | CMSTP | Defense Evasion |
 | T1055 | Process Injection | Defense Evasion, Privilege Escalation |
 | T1490 | Inhibit System Recovery | Impact |
@@ -4345,7 +4424,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | T1020 | Automated Exfiltration | Exfiltration |
 | T1569.002 | Service Execution | Execution |
 | T1486 | Data Encrypted for Impact | Impact |
-| T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion |
 
 #### Kill Chain Phase
 
@@ -4399,15 +4478,15 @@ Detect and investigate hosts in your environment that may be communicating with
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
-| T1071.004 | DNS | Command and Control |
+| T1071.004 | DNS | Command And Control |
 | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
-| T1095 | Non-Application Layer Protocol | Command and Control |
+| T1095 | Non-Application Layer Protocol | Command And Control |
 | T1041 | Exfiltration Over C2 Channel | Exfiltration |
 | T1189 | Drive-by Compromise | Initial Access |
 | T1114.001 | Local Email Collection | Collection |
 | T1114 | Email Collection | Collection |
 | T1114.003 | Email Forwarding Rule | Collection |
-| T1071.001 | Web Protocols | Command and Control |
+| T1071.001 | Web Protocols | Command And Control |
 
 #### Kill Chain Phase
 
@@ -4536,9 +4615,9 @@ Monitor for and investigate activities, including the creation or deletion of hi
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1070.005 | Network Share Connection Removal | Defense Evasion |
-| T1071.004 | DNS | Command and Control |
+| T1071.004 | DNS | Command And Control |
 | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
-| T1071.002 | File Transfer Protocols | Command and Control |
+| T1071.002 | File Transfer Protocols | Command And Control |
 | T1021.001 | Remote Desktop Protocol | Lateral Movement |
 | T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
 
@@ -4587,7 +4666,7 @@ Detect activities and various techniques associated with the Orangeworm Attack G
 | T1055 | Process Injection | Defense Evasion, Privilege Escalation |
 | T1106 | Native API | Execution |
 | T1569 | System Services | Execution |
-| T1574.011 | Services Registry Permissions Weakness | Defense Evasion, Persistence, Privilege Escalation |
+| T1574.011 | Services Registry Permissions Weakness | Persistence, Privilege Escalation, Defense Evasion |
 | T1543.003 | Windows Service | Persistence, Privilege Escalation |
 
 #### Kill Chain Phase
@@ -4702,6 +4781,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Wbemprox COM Object Execution](detections.md#wbemprox-com-object-execution)
 
+* [WevtUtil Usage To Clear Logs](detections.md#wevtutil-usage-to-clear-logs)
+
+* [Wevtutil Usage To Disable Logs](detections.md#wevtutil-usage-to-disable-logs)
+
 * [WinEvent Scheduled Task Created Within Public Path](detections.md#winevent-scheduled-task-created-within-public-path)
 
 * [WinEvent Scheduled Task Created to Spawn Shell](detections.md#winevent-scheduled-task-created-to-spawn-shell)
@@ -4713,7 +4796,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
 | T1490 | Inhibit System Recovery | Impact |
 | T1218.003 | CMSTP | Defense Evasion |
 | T1070.004 | File Deletion | Defense Evasion |
@@ -4736,7 +4819,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
 | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation |
 | T1036.003 | Rename System Utilities | Defense Evasion |
-| T1071.001 | Web Protocols | Command and Control |
+| T1071.001 | Web Protocols | Command And Control |
 | T1070 | Indicator Removal on Host | Defense Evasion |
 
 #### Kill Chain Phase
@@ -5160,7 +5243,7 @@ Quickly identify systems running new or unusual processes in your environment th
 | T1003 | OS Credential Dumping | Credential Access |
 | T1016 | System Network Configuration Discovery | Discovery |
 | T1059 | Command and Scripting Interpreter | Execution |
-|  |  |  |
+| T1117 | Regsvr32 |  |
 | T1202 | Indirect Command Execution | Defense Evasion |
 | T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
 | T1203 | Exploitation for Client Execution | Execution |
@@ -5273,7 +5356,7 @@ Windows services are often used by attackers for persistence and the ability to
 | T1055 | Process Injection | Defense Evasion, Privilege Escalation |
 | T1106 | Native API | Execution |
 | T1569 | System Services | Execution |
-| T1574.011 | Services Registry Permissions Weakness | Defense Evasion, Persistence, Privilege Escalation |
+| T1574.011 | Services Registry Permissions Weakness | Persistence, Privilege Escalation, Defense Evasion |
 | T1543.003 | Windows Service | Persistence, Privilege Escalation |
 
 #### Kill Chain Phase
@@ -5310,6 +5393,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Deleting Of Net Users](detections.md#deleting-of-net-users)
 
+* [Deny Permission using Cacls Utility](detections.md#deny-permission-using-cacls-utility)
+
 * [Disable Windows App Hotkeys](detections.md#disable-windows-app-hotkeys)
 
 * [Disabling Net User Account](detections.md#disabling-net-user-account)
@@ -5330,6 +5415,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Executables Or Script Creation In Suspicious Path](detections.md#executables-or-script-creation-in-suspicious-path)
 
+* [Grant Permission Using Cacls Utility](detections.md#grant-permission-using-cacls-utility)
+
 * [Hide User Account From Sign-In Screen](detections.md#hide-user-account-from-sign-in-screen)
 
 * [ICACLS Grant Command](detections.md#icacls-grant-command)
@@ -5338,6 +5425,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Modify ACL permission To Files Or Folder](detections.md#modify-acl-permission-to-files-or-folder)
 
+* [Modify ACLs Permission Of Files Or Folders](detections.md#modify-acls-permission-of-files-or-folders)
+
 * [Process Kill Base On File Path](detections.md#process-kill-base-on-file-path)
 
 * [Schtasks Run Task On Demand](detections.md#schtasks-run-task-on-demand)
@@ -5354,11 +5443,11 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1531 | Account Access Removal | Impact |
+| T1222 | File and Directory Permissions Modification | Defense Evasion |
 | T1562.001 | Disable or Modify Tools | Defense Evasion |
-| T1105 | Ingress Tool Transfer | Command and Control |
+| T1105 | Ingress Tool Transfer | Command And Control |
 | T1087 | Account Discovery | Discovery |
 | T1489 | Service Stop | Impact |
-| T1222 | File and Directory Permissions Modification | Defense Evasion |
 | T1036 | Masquerading | Defense Evasion |
 | T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
 | T1543.003 | Windows Service | Persistence, Privilege Escalation |
diff --git a/docs/stories.wiki b/docs/stories.wiki
index 498a8773d3..ddd0b29910 100644
--- a/docs/stories.wiki
+++ b/docs/stories.wiki
@@ -294,7 +294,7 @@ Adversaries may abuse BITS jobs to persistently execute or clean up after malici
 |-
 | T1105
 | Ingress Tool Transfer
-| Command and Control
+| Command And Control
 |}
 
 
@@ -438,7 +438,7 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 |-
 | T1071.002
 | File Transfer Protocols
-| Command and Control
+| Command And Control
 |-
 | T1218.010
 | Regsvr32
@@ -466,7 +466,7 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 |-
 | T1548
 | Abuse Elevation Control Mechanism
-| Defense Evasion, Privilege Escalation
+| Privilege Escalation, Defense Evasion
 |-
 | T1203
 | Exploitation for Client Execution
@@ -490,7 +490,7 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 |-
 | T1071.001
 | Web Protocols
-| Command and Control
+| Command And Control
 |-
 | T1018
 | Remote System Discovery
@@ -658,7 +658,7 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 |-
 | T1071.004
 | DNS
-| Command and Control
+| Command And Control
 |-
 | T1048.003
 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
@@ -666,7 +666,7 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 |-
 | T1095
 | Non-Application Layer Protocol
-| Command and Control
+| Command And Control
 |-
 | T1041
 | Exfiltration Over C2 Channel
@@ -690,7 +690,7 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 |-
 | T1071.001
 | Web Protocols
-| Command and Control
+| Command And Control
 |}
 
 
@@ -819,7 +819,7 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 |-
 | T1078
 | Valid Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |-
 | T1098
 | Account Manipulation
@@ -839,7 +839,7 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 |-
 | T1548
 | Abuse Elevation Control Mechanism
-| Defense Evasion, Privilege Escalation
+| Privilege Escalation, Defense Evasion
 |-
 | T1554
 | Compromise Client Software Binary
@@ -1011,7 +1011,7 @@ The stealing of data by an adversary.
 |-
 | T1071.004
 | DNS
-| Command and Control
+| Command And Control
 |-
 | T1048.003
 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
@@ -1019,7 +1019,7 @@ The stealing of data by an adversary.
 |-
 | T1095
 | Non-Application Layer Protocol
-| Command and Control
+| Command And Control
 |-
 | T1041
 | Exfiltration Over C2 Channel
@@ -1043,7 +1043,7 @@ The stealing of data by an adversary.
 |-
 | T1071.001
 | Web Protocols
-| Command and Control
+| Command And Control
 |}
 
 
@@ -1526,7 +1526,7 @@ Adversaries may transfer tools or other files from an external system into a com
 |-
 | T1105
 | Ingress Tool Transfer
-| Command and Control
+| Command And Control
 |-
 | T1003
 | OS Credential Dumping
@@ -1558,7 +1558,7 @@ Adversaries may transfer tools or other files from an external system into a com
 |-
 | T1548
 | Abuse Elevation Control Mechanism
-| Defense Evasion, Privilege Escalation
+| Privilege Escalation, Defense Evasion
 |-
 | T1055
 | Process Injection
@@ -1780,7 +1780,7 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an
 |-
 | T1105
 | Ingress Tool Transfer
-| Command and Control
+| Command And Control
 |-
 | T1003
 | OS Credential Dumping
@@ -1812,7 +1812,7 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an
 |-
 | T1548
 | Abuse Elevation Control Mechanism
-| Defense Evasion, Privilege Escalation
+| Privilege Escalation, Defense Evasion
 |-
 | T1055
 | Process Injection
@@ -2065,7 +2065,7 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 |-
 | T1071.002
 | File Transfer Protocols
-| Command and Control
+| Command And Control
 |-
 | T1218.010
 | Regsvr32
@@ -2093,7 +2093,7 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 |-
 | T1548
 | Abuse Elevation Control Mechanism
-| Defense Evasion, Privilege Escalation
+| Privilege Escalation, Defense Evasion
 |-
 | T1203
 | Exploitation for Client Execution
@@ -2117,7 +2117,7 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 |-
 | T1071.001
 | Web Protocols
-| Command and Control
+| Command And Control
 |-
 | T1018
 | Remote System Discovery
@@ -2292,7 +2292,7 @@ Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking
 |-
 | T1105
 | Ingress Tool Transfer
-| Command and Control
+| Command And Control
 |-
 | T1543.001
 | Launch Agent
@@ -2572,7 +2572,7 @@ Attackers often attempt to hide within or otherwise abuse the domain name system
 |-
 | T1071.004
 | DNS
-| Command and Control
+| Command And Control
 |-
 | T1048.003
 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
@@ -2580,7 +2580,7 @@ Attackers often attempt to hide within or otherwise abuse the domain name system
 |-
 | T1095
 | Non-Application Layer Protocol
-| Command and Control
+| Command And Control
 |-
 | T1041
 | Exfiltration Over C2 Channel
@@ -2604,7 +2604,7 @@ Attackers often attempt to hide within or otherwise abuse the domain name system
 |-
 | T1071.001
 | Web Protocols
-| Command and Control
+| Command And Control
 |}
 
 
@@ -2791,7 +2791,7 @@ Monitor your Okta environment for suspicious activities. Due to the Covid outbre
 |-
 | T1078.001
 | Default Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |}
 
 
@@ -3037,7 +3037,7 @@ Attackers are increasingly abusing Windows Management Instrumentation (WMI), a f
 |-
 | T1546.003
 | Windows Management Instrumentation Event Subscription
-| Persistence, Privilege Escalation
+| Privilege Escalation, Persistence
 |-
 | T1047
 | Windows Management Instrumentation
@@ -3098,7 +3098,7 @@ Monitor and detect registry changes initiated from remote locations, which can b
 |-
 | T1548.002
 | Bypass User Account Control
-| Defense Evasion, Privilege Escalation
+| Privilege Escalation, Defense Evasion
 |-
 | T1547.010
 | Port Monitors
@@ -3110,11 +3110,11 @@ Monitor and detect registry changes initiated from remote locations, which can b
 |-
 | T1546.012
 | Image File Execution Options Injection
-| Persistence, Privilege Escalation
+| Privilege Escalation, Persistence
 |-
 | T1546.011
 | Application Shimming
-| Persistence, Privilege Escalation
+| Privilege Escalation, Persistence
 |}
 
 
@@ -3405,6 +3405,8 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 
 * [[Documentation:ESSOC:detections:Detections#Eventvwr_uac_bypass|Eventvwr UAC Bypass]]
 
+* [[Documentation:ESSOC:detections:Detections#Excessive_number_of_service_control_start_as_disabled|Excessive number of service control start as disabled]]
+
 * [[Documentation:ESSOC:detections:Detections#Fodhelper_uac_bypass|FodHelper UAC Bypass]]
 
 * [[Documentation:ESSOC:detections:Detections#Hiding_files_and_directories_with_attrib_exe|Hiding Files And Directories With Attrib exe]]
@@ -3437,7 +3439,7 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 |-
 | T1548.002
 | Bypass User Account Control
-| Defense Evasion, Privilege Escalation
+| Privilege Escalation, Defense Evasion
 |-
 | T1112
 | Modify Registry
@@ -3528,7 +3530,7 @@ Monitors for behaviors associated with adversaries discovering objects in the en
 |-
 | T1078
 | Valid Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |-
 | T1087
 | Account Discovery
@@ -3624,7 +3626,7 @@ Monitors for behaviors associated with adversaries discovering objects in the en
 |-
 | T1574
 | Hijack Execution Flow
-| Defense Evasion, Persistence, Privilege Escalation
+| Persistence, Privilege Escalation, Defense Evasion
 |-
 | T1589.001
 | Credentials
@@ -3695,6 +3697,10 @@ Adversaries often try to cover their tracks by manipulating Windows logs. Use th
 
 * [[Documentation:ESSOC:detections:Detections#Usn_journal_deletion|USN Journal Deletion]]
 
+* [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_clear_logs|WevtUtil Usage To Clear Logs]]
+
+* [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_disable_logs|Wevtutil Usage To Disable Logs]]
+
 * [[Documentation:ESSOC:detections:Detections#Windows_event_log_cleared|Windows Event Log Cleared]]
 
 
@@ -3723,6 +3729,8 @@ Adversaries often try to cover their tracks by manipulating Windows logs. Use th
 
 * Actions on Objectives
 
+* Exploitation
+
 
 ====Reference====
 
@@ -3810,7 +3818,7 @@ Monitor for activities and techniques associated with maintaining persistence on
 |-
 | T1574.009
 | Path Interception by Unquoted Path
-| Defense Evasion, Persistence, Privilege Escalation
+| Persistence, Privilege Escalation, Defense Evasion
 |-
 | T1222.001
 | Windows File and Directory Permissions Modification
@@ -3822,7 +3830,7 @@ Monitor for activities and techniques associated with maintaining persistence on
 |-
 | T1078
 | Valid Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |-
 | T1098
 | Account Manipulation
@@ -3846,7 +3854,7 @@ Monitor for activities and techniques associated with maintaining persistence on
 |-
 | T1548
 | Abuse Elevation Control Mechanism
-| Defense Evasion, Privilege Escalation
+| Privilege Escalation, Defense Evasion
 |-
 | T1547.010
 | Port Monitors
@@ -3854,7 +3862,7 @@ Monitor for activities and techniques associated with maintaining persistence on
 |-
 | T1574.011
 | Services Registry Permissions Weakness
-| Defense Evasion, Persistence, Privilege Escalation
+| Persistence, Privilege Escalation, Defense Evasion
 |-
 | T1547.001
 | Registry Run Keys / Startup Folder
@@ -3862,7 +3870,7 @@ Monitor for activities and techniques associated with maintaining persistence on
 |-
 | T1546.011
 | Application Shimming
-| Persistence, Privilege Escalation
+| Privilege Escalation, Persistence
 |-
 | T1543.003
 | Windows Service
@@ -3949,15 +3957,15 @@ Monitor for and investigate activities that may be associated with a Windows pri
 |-
 | T1548
 | Abuse Elevation Control Mechanism
-| Defense Evasion, Privilege Escalation
+| Privilege Escalation, Defense Evasion
 |-
 | T1546.008
 | Accessibility Features
-| Persistence, Privilege Escalation
+| Privilege Escalation, Persistence
 |-
 | T1078
 | Valid Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |-
 | T1098
 | Account Manipulation
@@ -3965,7 +3973,7 @@ Monitor for and investigate activities that may be associated with a Windows pri
 |-
 | T1546.012
 | Image File Execution Options Injection
-| Persistence, Privilege Escalation
+| Privilege Escalation, Persistence
 |}
 
 
@@ -4119,7 +4127,7 @@ Detect instances of prohibited network traffic allowed in the environment, as we
 |-
 | T1071.001
 | Web Protocols
-| Command and Control
+| Command And Control
 |}
 
 
@@ -4190,11 +4198,11 @@ Validate the security configuration of network infrastructure and verify that on
 |-
 | T1557.002
 | ARP Cache Poisoning
-| Collection, Credential Access
+| Credential Access, Collection
 |-
 | T1557
 | Man-in-the-Middle
-| Collection, Credential Access
+| Credential Access, Collection
 |-
 | T1542.005
 | TFTP Boot
@@ -4304,7 +4312,7 @@ Track when a user assumes an IAM role in another AWS account to obtain cross-acc
 |-
 | T1078
 | Valid Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |-
 | T1550
 | Use Alternate Authentication Material
@@ -4369,7 +4377,7 @@ This analytic story contains detections that query your AWS Cloudtrail for activ
 |-
 | T1078.004
 | Cloud Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |-
 | T1136.003
 | Cloud Account
@@ -4582,7 +4590,7 @@ Monitor your cloud compute instances for activities related to cryptojacking/cry
 |-
 | T1078.004
 | Cloud Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |-
 | T1535
 | Unused/Unsupported Cloud Regions
@@ -4649,7 +4657,7 @@ This analytical story addresses events that indicate abuse of cloud federated cr
 |-
 | T1078
 | Valid Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |-
 | T1003.001
 | LSASS Memory
@@ -4665,7 +4673,7 @@ This analytical story addresses events that indicate abuse of cloud federated cr
 |-
 | T1546.012
 | Image File Execution Options Injection
-| Persistence, Privilege Escalation
+| Privilege Escalation, Persistence
 |}
 
 
@@ -4763,7 +4771,7 @@ Track when a user assumes an IAM role in another GCP account to obtain cross-acc
 |-
 | T1078
 | Valid Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |}
 
 
@@ -5187,7 +5195,7 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 |-
 | T1078.004
 | Cloud Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |}
 
 
@@ -5238,7 +5246,7 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 |-
 | T1078
 | Valid Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |}
 
 
@@ -5291,11 +5299,11 @@ Detect and investigate suspicious activities by users and roles in your cloud en
 |-
 | T1078.004
 | Cloud Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |-
 | T1078
 | Valid Accounts
-| Defense Evasion, Initial Access, Persistence, Privilege Escalation
+| Defense Evasion, Persistence, Privilege Escalation, Initial Access
 |}
 
 
@@ -5370,6 +5378,88 @@ Use the searches in this Analytic Story to monitor your GCP Storage buckets for
 
 
 
+==Lateral Movement==
+
+
+===Printnightmare cve-2021-34527===
+The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547.012/ T1547.012], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1068/ T1068]
+* '''Last Updated''': 2021-07-01
+
+

+

+
+====Detection Profile====
+
+* [[Documentation:ESSOC:detections:Detections#Print_spooler_adding_a_printer_driver|Print Spooler Adding A Printer Driver]]
+
+* [[Documentation:ESSOC:detections:Detections#Print_spooler_failed_to_load_a_plug-in|Print Spooler Failed to Load a Plug-in]]
+
+* [[Documentation:ESSOC:detections:Detections#Rundll32_with_no_command_line_arguments_with_network|Rundll32 with no Command Line Arguments with Network]]
+
+* [[Documentation:ESSOC:detections:Detections#Spoolsv_spawning_rundll32|Spoolsv Spawning Rundll32]]
+
+* [[Documentation:ESSOC:detections:Detections#Spoolsv_suspicious_loaded_modules|Spoolsv Suspicious Loaded Modules]]
+
+* [[Documentation:ESSOC:detections:Detections#Spoolsv_suspicious_process_access|Spoolsv Suspicious Process Access]]
+
+* [[Documentation:ESSOC:detections:Detections#Spoolsv_writing_a_dll|Spoolsv Writing a DLL]]
+
+* [[Documentation:ESSOC:detections:Detections#Spoolsv_writing_a_dll_-_sysmon|Spoolsv Writing a DLL - Sysmon]]
+
+* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_no_command_line_arguments|Suspicious Rundll32 no Command Line Arguments]]
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1547.012
+| Print Processors
+| Persistence, Privilege Escalation
+|-
+| T1218.011
+| Rundll32
+| Defense Evasion
+|-
+| T1068
+| Exploitation for Privilege Escalation
+| Privilege Escalation
+|}
+
+
+====Kill Chain Phase====
+
+* Actions on Objectives
+
+* Exploitation
+
+
+====Reference====
+
+* https://github.com/cube0x0/CVE-2021-1675/
+
+* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
+
+* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
+
+* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
+
+
+''version'': 1
+

+

+
+----
+
+
+
 ==Malware==
 
 
@@ -5412,6 +5502,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Suspicious_wevtutil_usage|Suspicious wevtutil Usage]]
 
+* [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_clear_logs|WevtUtil Usage To Clear Logs]]
+
 * [[Documentation:ESSOC:detections:Detections#Windows_event_log_cleared|Windows Event Log Cleared]]
 
 
@@ -5579,7 +5671,7 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 |-
 | T1071.002
 | File Transfer Protocols
-| Command and Control
+| Command And Control
 |-
 | T1021.002
 | SMB/Windows Admin Shares
@@ -5708,7 +5800,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 |-
 | T1105
 | Ingress Tool Transfer
-| Command and Control
+| Command And Control
 |-
 | T1218.003
 | CMSTP
@@ -5744,7 +5836,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 |-
 | T1548.002
 | Bypass User Account Control
-| Defense Evasion, Privilege Escalation
+| Privilege Escalation, Defense Evasion
 |}
 
 
@@ -5809,7 +5901,7 @@ Detect and investigate hosts in your environment that may be communicating with
 |-
 | T1071.004
 | DNS
-| Command and Control
+| Command And Control
 |-
 | T1048.003
 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
@@ -5817,7 +5909,7 @@ Detect and investigate hosts in your environment that may be communicating with
 |-
 | T1095
 | Non-Application Layer Protocol
-| Command and Control
+| Command And Control
 |-
 | T1041
 | Exfiltration Over C2 Channel
@@ -5841,7 +5933,7 @@ Detect and investigate hosts in your environment that may be communicating with
 |-
 | T1071.001
 | Web Protocols
-| Command and Control
+| Command And Control
 |}
 
 
@@ -6001,7 +6093,7 @@ Monitor for and investigate activities, including the creation or deletion of hi
 |-
 | T1071.004
 | DNS
-| Command and Control
+| Command And Control
 |-
 | T1048.003
 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
@@ -6009,7 +6101,7 @@ Monitor for and investigate activities, including the creation or deletion of hi
 |-
 | T1071.002
 | File Transfer Protocols
-| Command and Control
+| Command And Control
 |-
 | T1021.001
 | Remote Desktop Protocol
@@ -6084,7 +6176,7 @@ Detect activities and various techniques associated with the Orangeworm Attack G
 |-
 | T1574.011
 | Services Registry Permissions Weakness
-| Defense Evasion, Persistence, Privilege Escalation
+| Persistence, Privilege Escalation, Defense Evasion
 |-
 | T1543.003
 | Windows Service
@@ -6205,6 +6297,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Wbemprox_com_object_execution|Wbemprox COM Object Execution]]
 
+* [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_clear_logs|WevtUtil Usage To Clear Logs]]
+
+* [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_disable_logs|Wevtutil Usage To Disable Logs]]
+
 * [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]
 
 * [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_to_spawn_shell|WinEvent Scheduled Task Created to Spawn Shell]]
@@ -6221,7 +6317,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 |-
 | T1548
 | Abuse Elevation Control Mechanism
-| Defense Evasion, Privilege Escalation
+| Privilege Escalation, Defense Evasion
 |-
 | T1490
 | Inhibit System Recovery
@@ -6313,7 +6409,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 |-
 | T1071.001
 | Web Protocols
-| Command and Control
+| Command And Control
 |-
 | T1070
 | Indicator Removal on Host
@@ -6821,7 +6917,7 @@ Quickly identify systems running new or unusual processes in your environment th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1016/ T1016], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques// ], [https://attack.mitre.org/techniques/T1202/ T1202], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1072/ T1072], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1190/ T1190]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1016/ T1016], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1117/ T1117], [https://attack.mitre.org/techniques/T1202/ T1202], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1072/ T1072], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1190/ T1190]
 * '''Last Updated''': 2020-02-04
 
 

@@ -6879,8 +6975,8 @@ Quickly identify systems running new or unusual processes in your environment th
 | Command and Scripting Interpreter
 | Execution
 |-
-| 
-| 
+| T1117
+| Regsvr32
 | 
 |-
 | T1202
@@ -7055,7 +7151,7 @@ Windows services are often used by attackers for persistence and the ability to
 |-
 | T1574.011
 | Services Registry Permissions Weakness
-| Defense Evasion, Persistence, Privilege Escalation
+| Persistence, Privilege Escalation, Defense Evasion
 |-
 | T1543.003
 | Windows Service
@@ -7088,7 +7184,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543]
 * '''Last Updated''': 2021-05-07
 
 

@@ -7098,6 +7194,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Deleting_of_net_users|Deleting Of Net Users]]
 
+* [[Documentation:ESSOC:detections:Detections#Deny_permission_using_cacls_utility|Deny Permission using Cacls Utility]]
+
 * [[Documentation:ESSOC:detections:Detections#Disable_windows_app_hotkeys|Disable Windows App Hotkeys]]
 
 * [[Documentation:ESSOC:detections:Detections#Disabling_net_user_account|Disabling Net User Account]]
@@ -7118,6 +7216,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Executables_or_script_creation_in_suspicious_path|Executables Or Script Creation In Suspicious Path]]
 
+* [[Documentation:ESSOC:detections:Detections#Grant_permission_using_cacls_utility|Grant Permission Using Cacls Utility]]
+
 * [[Documentation:ESSOC:detections:Detections#Hide_user_account_from_sign-in_screen|Hide User Account From Sign-In Screen]]
 
 * [[Documentation:ESSOC:detections:Detections#Icacls_grant_command|ICACLS Grant Command]]
@@ -7126,6 +7226,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Modify_acl_permission_to_files_or_folder|Modify ACL permission To Files Or Folder]]
 
+* [[Documentation:ESSOC:detections:Detections#Modify_acls_permission_of_files_or_folders|Modify ACLs Permission Of Files Or Folders]]
+
 * [[Documentation:ESSOC:detections:Detections#Process_kill_base_on_file_path|Process Kill Base On File Path]]
 
 * [[Documentation:ESSOC:detections:Detections#Schtasks_run_task_on_demand|Schtasks Run Task On Demand]]
@@ -7148,13 +7250,17 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Account Access Removal
 | Impact
 |-
+| T1222
+| File and Directory Permissions Modification
+| Defense Evasion
+|-
 | T1562.001
 | Disable or Modify Tools
 | Defense Evasion
 |-
 | T1105
 | Ingress Tool Transfer
-| Command and Control
+| Command And Control
 |-
 | T1087
 | Account Discovery
@@ -7164,10 +7270,6 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Service Stop
 | Impact
 |-
-| T1222
-| File and Directory Permissions Modification
-| Defense Evasion
-|-
 | T1036
 | Masquerading
 | Defense Evasion
@@ -7321,7 +7423,7 @@ In March of 2016, adversaries were seen using JexBoss--an open-source utility us
 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-06-24 18:14:07.654798 UTC
+# On Date: 2021-07-02 15:57:11.500371 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############